Hash Identifier

Hex lengths and the extra candidates

After cleanup, a string that is only hexadecimal digits is looked up by character count. 32 digits add MD5 at high confidence. 40 digits add SHA-1 at high and RIPEMD-160 at medium. 56 digits add SHA-224 at high. 64 digits add SHA-256 at high and BLAKE2s at low, which is why the empty-string sample prints two lines. 96 digits add SHA-384 at high. 128 digits add SHA-512 at high and SHA-512/256 at low. That last low row is in the table even though a SHA-512/256 digest is normally 64 hex digits. The page is reporting the table, not proving the function. Any other hex length adds nothing from this branch.

Confidence is a label on the row, not a probability. high means the length is the usual width for that name. medium on a 40-digit string means RIPEMD-160 shares the width with SHA-1. low means the table mentions another name at that width. You still have to know which function your system called. To recompute a candidate, open the matching generator: MD5, SHA-1, SHA-256, or SHA-512. A value that only matches when you also hold a secret is not identified here. That construction is on the HMAC generator.

bcrypt, Argon2, and Base64 widths

bcrypt matches the whole string against a modular-crypt pattern: a dollar, 2, an optional a, b, or y, a dollar, two cost digits, a dollar, and 53 characters from the bcrypt alphabet. $2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy is high confidence with the reason Matches the bcrypt modular crypt format. A shorter body does not match, and the page does not check the cost against a password. Argon2 matches only a prefix: $argon2id$, $argon2i$, or $argon2d$. The rest of the string is not parsed, so $argon2id$v=19$m=65536 is already high confidence with the reason Matches an Argon2 encoded hash prefix.

A separate check accepts the standard Base64 alphabet when the length is a multiple of four. It estimates the decoded byte count from the unpadded length and adds a medium line when that count is 16 (MD5), 20 (SHA-1), 32 (SHA-256), or 64 (SHA-512). The MD5 line then reads MD5 (Base64). Hex strings of the usual digest lengths do not also hit those byte counts, so the empty-string sample stays on the hex rows. A value can still collect more than one row when two checks both fire. The lines are stacked. They are not ranked beyond the order the checks run: bcrypt, Argon2, hex rows, then Base64 rows.

Cleanup before the checks

The field is trimmed, a single leading 0x or 0X is removed, and every whitespace run is deleted. 0x followed by the 32-digit MD5 of an empty message still reports MD5. Spaces inserted between hex pairs are removed, so a wrapped digest can match. Newlines are whitespace too, which means two digests pasted on separate lines become one string. That combined length usually misses the table. Paste one value.

Identify hash is a click. Load SHA-256 sample only fills the box. The status on success is Found N candidate or Found N candidates. Copy output copies the lines with their em dashes. There is no file-picker and no download. The page never calls a hash function, so it cannot tell you that the sample is the empty string. It can tell you the sample has the 64-digit shape.

Unknown and strings that only look familiar

If no check adds a row, the result is a single low line: Unknown, with a reason that includes the cleaned character count. hello is Unknown for a 5-character value. A hex string of 24 digits is also Unknown, because 24 is not in the hex table and the Base64 byte estimate for that length is not 16, 20, 32, or 64. An almost-bcrypt string with the wrong body length is Unknown rather than a low bcrypt.

Do not treat a high row as proof. Two functions can share a width, the SHA-512/256 row on a 128-digit string is the table being broad, and a Base64 medium row is only a length. Recompute on the generator that matches the system you are checking. This page will not uppercase the hex, will not turn hex into Base64, and will not compare the digest with a file.

Rules and limitations

One cleaned string per run. 0x and whitespace are removed first. Hex lengths 32, 40, 56, 64, 96, and 128 map to the families above, including the extra RIPEMD-160, BLAKE2s, and SHA-512/256 rows. bcrypt needs the full modular-crypt shape. Argon2 needs only the prefix.

Base64 medium rows are byte-length guesses. Nothing is hashed. Unknown is the fallback. There is no download control. HMAC is not a row in the table.

Common problems

If a 64-digit hex string lists BLAKE2s as well as SHA-256, both rows are in the table. The low label is the weaker one. Confirm by recomputing, not by deleting the second line.

If two digests became Unknown, a newline between them was removed and the lengths were added together. Classify one digest at a time.

Frequently asked questions

About this tool

Maintained by Toolbench. For large or deeply nested files, split the input into smaller batches and verify representative results before using them in an import or application. Report reproducible problems through Contact.