Question 1

How does this work?

Accepted Answer

Pattern matching. Hash formats with distinctive prefixes ($2y$, $argon2id$, $apr1$, $P$, $S$, $wp$, {SHA}, SCRAM-SHA-256$, etc) are detected reliably — high confidence. Hashes without prefixes (raw hex strings) are detected by length and character set, with medium confidence because multiple algorithms produce the same length. For example, any 32-char hex string could be MD5, NTLM, MD4, MD2, or several others. High confidence = format definitively matches one algorithm. Medium = length matches multiple algorithms but the distinguishing context is unavailable. Low = base64 or other encoding where length alone is a weak signal.

Question 2

Why is my MD5 hash flagged as 'MD5 / NTLM / MD4'?

Accepted Answer

All three produce 32 hex characters and there's no way to tell them apart from the hash alone. Context clues help: NTLM is typically UPPERCASE in cracking tool output, MD5 is typically lowercase, MD4 is rare outside NTLM. If you know the source system, you can disambiguate: extracted from Windows registry/SAM → NTLM; PostgreSQL md5 column → MD5; legacy phpBB → MD4. The tool flags all three so you don't pass an MD5 to a tool expecting NTLM and get confused when it doesn't crack.

Question 3

Can I use this to crack a hash?

Accepted Answer

No — this tool only identifies the algorithm. Cracking requires running the hash through a tool like hashcat or John the Ripper with a dictionary or brute-force ruleset. Knowing the algorithm is the first step (you have to tell hashcat the right mode, e.g. -m 0 for MD5, -m 1000 for NTLM, -m 3200 for bcrypt), but the cracking itself isn't this tool's job. For legitimate password recovery (your own hash, your company's hash with authorization), use hashcat on a GPU rig. For other uses, you're probably looking at illegal access — don't.

Question 4

What about hashes I don't recognize?

Accepted Answer

If the tool returns 'No matches', the format is either not in the database, has extra whitespace, is partially copied, or uses a custom format. Try: trim leading/trailing spaces, check for line breaks inside the hash (some copy-paste operations split long hashes), confirm the hash isn't base64-encoded when you expected hex. If you genuinely have an exotic format (rare cryptocurrency wallets, legacy enterprise systems, custom KDF), the tool can't help — you'd need to find the source application's documentation.

Hash Identifier

Frequently Asked Questions