Paste a hash to see what it probably is: MD5, NTLM, SHA-1, SHA-256, bcrypt, sha512crypt, Kerberos, NetNTLMv2 and more, with hashcat modes and where each type usually comes from.
Runs in your browser. Nothing you paste is uploaded, stored or logged.
How it works
Hashes turn up everywhere in an investigation: file hashes in alerts, password hashes in a breached database, NTLM hashes in a credential dump, Kerberos tickets from a Kerberoasting attack. Knowing which type you have decides what to do next, whether that is a threat-intelligence lookup, a password audit or an incident report.
Paste one hash or a list. Each is matched against known formats: prefixed password hashes from Linux, web frameworks, LDAP, MySQL and Cisco; Windows formats such as NTLM, NetNTLMv2 and DCC2; Kerberos TGS-REP and AS-REP; similarity hashes such as ssdeep and TLSH; JA4 fingerprints; and plain hex and Base64 digests by length. Each match shows how likely it is, where it usually comes from and, where unambiguous, the hashcat mode.
Questions
How can you tell what type a hash is?
From its shape. Many formats start with a fixed prefix, such as $2b$ for bcrypt, $6$ for sha512crypt or $krb5tgs$ for a Kerberos service ticket, and those identifications are certain. Plain hex hashes carry no label, so they are identified by length: a 32-character value could be MD5, NTLM or another 128-bit hash. The most common type in security work is listed first, and where the hash came from usually decides it.
Is a 32-character hash MD5 or NTLM?
Both are 32 hex characters, so the value alone cannot tell them apart. A hash from a Windows credential dump (SAM, NTDS.dit, LSASS, secretsdump output) is NTLM. A file hash in a threat report or EDR alert is MD5. JA3 TLS fingerprints and imphash values are also MD5-shaped.
What are the hashcat modes for?
hashcat, the password-recovery tool, needs the hash type passed with -m. The mode is shown only where a format maps to one mode unambiguously. Use it for authorised password audits and penetration tests only.
Is the hash sent anywhere?
No. Identification runs entirely in your browser, from the hash’s shape alone. Nothing is uploaded, looked up or logged, which matters for password hashes from an incident.