Hash Type Identifier
Paste a hash and find out what produced it: bcrypt and its cost, Argon2 and its parameters, crypt formats from /etc/shadow, MySQL and PostgreSQL password hashes, or a plain digest by length.
Free · No sign-up · Your inputs stay in your browser
Input
Identify a hash by its format
Output
bcrypt
bcrypt
60 characters
Cost factor 12 (2^12 rounds). PHP's password_hash() default and Laravel's Hash::make(). y$ is PHP's marker; b$ is the same algorithm elsewhere.
Identified by prefix, alphabet and length only, so a bare 64-character hex string could be any 256-bit hash. Modular-crypt strings ($2y$, $argon2id$, $6$) name their algorithm and parameters, which is why password_hash() output can be verified without knowing how it was made.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
Self-describing hashes
Password hashes from password_hash(), crypt() and Argon2 carry their own algorithm and parameters: $2y$12$ is bcrypt at cost 12, and $argon2id$v=19$m=65536,t=4,p=1$ spells out memory, iterations and parallelism. That is why password_verify() needs no hint, and why password_needs_rehash() can tell when a stored hash is weaker than the current setting.
Bare digests are ambiguous
A 64-character hex string is 256 bits, which could be SHA-256, SHA3-256 or BLAKE2s. Only the system that produced it knows. If you find a bare fast hash in a users table, the passwords need migrating: rehash each one with bcrypt or Argon2 at the user's next login.
