What does this tool do?
Hash Identifier takes a hash you paste and identifies the likely hash type(s) from its length, charset and prefix patterns, then outputs the matching 'hashcat -m <mode>' and 'john --format=<name>' commands ready to run. It recognises MD5, NTLM, SHA1/256/512, bcrypt, md5crypt, sha512crypt, Kerberoast, AS-REP, NetNTLMv2, MySQL, JWT and WordPress phpass among dozens of formats. Everything runs in your browser and no data is sent to any server.
How to use it
- Enter your listener IP and port.
- Pick the command or payload that fits your setup.
- Copy it and use it only on systems you are authorized to test.
What it solves
During a pentest you cannot feed hashcat the right -m mode without first knowing what the dumped hash is. This tool reads prefixes ($2a$, $6$, $krb5tgs$, $P$) and format signatures, shows multiple candidates when ambiguous, and gives a ready cracking command for each. Pair the result with the Hashcat Command Builder to launch the attack in one step.
Limits of heuristic detection
Detection is probabilistic, not certain: a 32-character hex string can be MD5 (-m 0) or NTLM (-m 1000), so the tool lists both and tells you to choose by context. Unix crypt formats that start with $ are distinguished cleanly by their prefix, while for bare hex or base64 strings the length is the strongest clue. When in doubt, just try both modes.
Frequently asked questions
How does it know the type?
It uses heuristics that match the length, charset (hex, base64, alphanumeric) and prefix signatures such as '$1$', '$2a$', '$6$' or '$krb5tgs$'. This is not guaranteed — when several formats fit the same pattern it shows all of them as candidates.
MD5 and NTLM are both 32 hex characters — how do I tell them apart?
You cannot tell them apart from the hash alone, since both are 32-digit hex. Use the source context: if it came from a Windows SAM/NTDS.dit dump it is NTLM (-m 1000); from a web app database it is most likely MD5 (-m 0). If unsure, run both modes against the same wordlist.
What do I do after identifying it?
Pass the suggested -m mode to hashcat, e.g. 'hashcat -m 1000 hashes.txt rockyou.txt'. If you use John, take the recommended '--format=' value. You can also push the mode straight into the Hashcat Command Builder to add rules and masks.
Is Hash Identifier free?
Yes. Hash Identifier and all 300+ tools on MagmaNex are completely free with no signup or account required.
Is my data safe?
Yes. Everything runs locally in your browser. The data you enter is never sent to a server, stored, or shared.
Does it work on mobile?
Yes. Hash Identifier works on phones, tablets and desktops — no app download needed.
🔒 Privacy: everything runs in your browser, your data is never sent to a server.