How to Identify a Hash Type (MD5, SHA-256, bcrypt, NTLM and More)

Short answer: look at the string's structure before its length. A leading $…$ prefix usually names the scheme outright ($2b$ is bcrypt, $6$ is SHA-512 crypt, $argon2id$ is Argon2id). If there's no prefix, check the alphabet, then count the characters: 32 hex characters is 128 bits (MD5, MD4 or NTLM), 40 is 160 bits (SHA-1), 64 is 256 bits (SHA-256 and others). Then use where the hash came from to break ties, and confirm with a value you know.

Identification gives you a shortlist of likely algorithms, not proof. Several algorithms share an output size, so a bare hex string can match more than one of them. The method below narrows the list quickly and tells you when the string alone can't settle it.

Step 1: Clean up the string

Copy the hash exactly and check for anything that isn't part of the digest:

• Leading or trailing whitespace, line breaks, or quotes from a CSV or JSON export.
• A username or ID in front, as in alice:8743b5….
• A salt after a separator, such as hash:salt. Hashcat's example list shows several salted modes in this form.
• Text that looks like a hash but is an encoding, for example Base64 ending in =.

Note the separators instead of deleting them. A colon followed by a short random string often means the scheme is salted, which changes the candidates.

Step 2: Look for a prefix

Modular crypt strings carry their scheme in the first field, between dollar signs. These are the common ones:

Prefix	Scheme	Typical length	Hashcat mode
$1$	md5crypt (MD5-based Unix crypt)	up to 34	500
$5$	sha256crypt	varies (optional rounds=)	7400
$6$	sha512crypt	varies (optional rounds=)	1800
$2a$, $2b$ and other $2…$	bcrypt	60	3200
$argon2id$, $argon2i$, $argon2d$	Argon2	varies	34000 (Argon2, as listed by Hashcat)

The fields after the prefix carry parameters. In a bcrypt string such as $2b$12$…, the 12 is the cost factor (OpenBSD crypt(3)), and the rest is the salt and the hash. An Argon2 string spells out its memory, time and parallelism settings (m=…,t=…,p=…), which matches the parameters defined for Argon2 in RFC 9106. SHA-crypt strings may include rounds= before the salt.

If you find a prefix, you're usually done: the scheme is named in the string itself. The rest of this guide is for bare digests.

Step 3: Check the character set

• Just 0–9 and a–f (or A–F): hexadecimal. Each character is 4 bits, so the length converts straight to a digest size.
• Letters of both cases, digits, + and /, maybe = padding: Base64. Decode it to bytes and count the bytes; 32 bytes, for example, is a 256-bit digest.
• Letters, digits, . and /: the alphabet used inside crypt-style strings (bcrypt and the SHA-crypt family). Without a prefix, the string may have been truncated or stored in pieces.

Step 4: Count the length

For hex, multiply the length by 4 to get bits. If base conversion is rusty, the binary, hex and octal cheat sheet covers why one hex digit equals four bits.

Hex characters	Bits	Common candidates	Hashcat mode
32	128	MD5 · MD4 · NTLM	0 · 900 · 1000
40	160	SHA-1	100
56	224	SHA-224, SHA3-224	check the example list
64	256	SHA-256, SHA3-256	1400 for SHA-256
96	384	SHA-384, SHA3-384	check the example list
128	512	SHA-512, SHA3-512	1700 for SHA-512

The 32-character row shows the core limitation. MD5 produces a 128-bit digest (RFC 1321). NTLM's password hash is MD4 applied to the UTF-16 form of the password, per Microsoft's protocol specification, and MD4 is also 128 bits. All three look identical: 32 hex characters with no marker. The same applies to SHA-2 and SHA-3 at equal sizes (FIPS 180-4 defines the SHA-2 digest lengths).

Step 5: Use the context to break ties

Where the hash came from often decides it:

• A Windows credential store (SAM/NTDS dump): NTLM is the likely candidate for a 32-character value. Captured NTLM network logins are different: they use the longer NetNTLMv1/v2 challenge-response format (Hashcat modes 5500 and 5600 on Hashcat's example-hashes page), not a bare 32-character hash.
• A Linux /etc/shadow file: expect a crypt prefix such as $6$ or a newer scheme from your distribution.
• A web application's user table: check the framework's documentation or code for the hashing function it calls.
• A file checksum next to a download: the publisher usually labels it (SHA256SUMS, "MD5").
• A CTF challenge: the title, the file name or a hint often names the algorithm.

Step 6: Confirm with a known value

On a system you control, the reliable test is a value you already know. Create a test account or record with a known input, hash that input with your candidate algorithm (Python's hashlib module, for example), and compare the result with what the system stored. If they match, you have the algorithm and you know whether a salt is involved. Hashcat's example-hashes page is also useful here: compare your string's shape with the example for the mode you plan to use.

Knowing the algorithm doesn't reveal the input. It tells you what you're looking at, and whether the scheme is still appropriate. RFC 6151, for instance, says it isn't prudent to use MD5 where collision resistance is required.

Doing it in the browser with HashLens

If you identify hashes often, HashLens puts these checks in a browser popup. According to its Chrome Web Store listing, you paste a hash into the Identify tab and it lists candidate algorithms from more than 20 supported formats, including MD5, SHA-256, bcrypt, NTLM and Argon2. It detects prefixes such as $2a$ and $6$ automatically, and shows the Hashcat mode number and the John the Ripper format string for each candidate. The listing also describes a security rating (Secure, Weak or Broken), clipboard detection, and a right-click option to identify selected text.

The listing says hashes are processed in your browser using the @noble/hashes library, and the extension requests no host permissions.

HashLens doesn't remove the ambiguity in Step 4. A 32-character hex string still matches more than one candidate, such as MD5 and NTLM, so Steps 5 and 6 still apply.

FAQ

Can you tell MD5 and NTLM apart just by looking?

No. Both produce 128-bit values usually written as 32 hex characters, with no marker. Use the source of the hash, or hash a known input both ways and compare.

Which Hashcat mode should I use for a hash?

Identify the algorithm first, then look the mode up on Hashcat's example-hashes page: for example 0 for MD5, 1000 for NTLM, 1400 for SHA-256 and 3200 for bcrypt. Compare your string with the example for that mode before you run anything.

Is a 64-character hex hash always SHA-256?

No. Any 256-bit digest written in hex is 64 characters, including SHA3-256. SHA-256 is a frequent candidate, but context or a known-value test should confirm it.

To identify hashes from the browser, add HashLens to Chrome. It's free.

More about the extension: HashLens.