Hash Format Tester (Type Identification)

What it does

Paste any hash string and this tool inspects its length, character set, and structure to guess which hashing algorithm or format likely produced it — for example Windows LM, NTLM, NTLMv2 (challenge/response), or general-purpose digests like MD5, SHA-1, SHA-256, SHA-512, and salted formats like bcrypt or $1$/$5$/$6$ crypt hashes.

This is a heuristic identifier only — it never attempts to crack, brute-force, or reverse the hash, and nothing is sent anywhere: all analysis happens locally, instantly, in your browser.

⚠️ Hash identification by structure alone is inherently ambiguous: a 32-character hex string could be MD5, NTLM, LM (half of it), or many other 128-bit digests. The tool lists every plausible match ranked by how well it fits, rather than pretending to give a single certain answer.

Once a format is identified, the tool also suggests the matching hashcat (-m) and John the Ripper (--format) command you'd use to attempt to crack it with a wordlist/rules of your own — for legitimate password-audit and pentesting use only. No cracking is ever performed by this tool — it only prints the command line you would run yourself, locally, with your own tools and wordlists.

Try it

Cracking command suggestions

For every plausible format detected, the tool prints the corresponding hashcat mode number and john format name, plus a ready-to-copy example command using a wordlist (rockyou.txt as a placeholder — swap in your own list):

⚠️ Always audit responsibly. Only attempt to crack hashes you own, that belong to systems you're explicitly authorized to test, or that were provided to you as part of a legitimate security assessment/CTF.

How it works

1. The hash you paste is trimmed and analyzed entirely in your browser — nothing is transmitted over the network.
2. The tool checks, in order:

• Known prefix markers ($2a$, $2b$, $2y$, $1$, $5$, $6$, {SHA}, {SSHA}) which are unambiguous.
• Colon-separated structure (user:domain:challenge:hmac...), which strongly suggests a captured NTLMv2 (Net-NTLMv2) challenge/response rather than a stored password hash.
• Raw length + character set against the table above.
• Whether the string looks like Base64 rather than hex (mixed case + digits + +/=, length divisible by 4).

1. Every rule that matches is shown as a possible format, with a short note on why, sorted from most to least specific/confident.
2. Nothing is stored, logged, or sent anywhere — you can safely paste real captured hashes for identification purposes.

Limitations

• Structure-only identification cannot definitively distinguish between algorithms that produce the same-length output (e.g. raw MD5, NTLM, and MD4 are all 32 hex characters) — the tool will list all plausible candidates rather than a false single answer.
• LM hashes are technically also 32 hex chars; the tool flags the well-known empty-half suffix (AAD3B435B51404EE) as a strong LM hint when present, but its absence doesn't rule out LM.
• This tool does not validate whether a hash is real — a random 32-character hex string will match the same rules as an actual MD5 digest.
• The suggested hashcat/john commands are based purely on the detected format's name — always double check the mode number against hashcat --help or john --list=formats, since hashcat mode numbers occasionally change or get split into sub-variants (e.g. NTLMv2 vs. NTLMv2 with different HMAC construction) that this tool cannot distinguish from structure alone.