Hash Type Detector — Identify Hash Format

Introduction

A database dump contains opaque password column values — are they MD5, bcrypt, or Argon2? Migration planning depends on identification. Security responders triage breach exports by hash format. Students learning cryptography encounter hex strings without labels. Full hash identification requires specialized tools and caution — Certoflow provides educational heuristics, not forensic certainty.

Certoflow's Hash Type Detector inspects trimmed input length and prefixes, returning likely algorithm labels. MD5 (32 hex), SHA-1 (40 hex), SHA-256 (64 hex), SHA-512 (128 hex), bcrypt ($2a$, $2b$), Argon2 ($argon2). Unknown formats get guidance to check length and prefix. Local analysis only — paste samples, not live production databases in untrusted environments. Verify with MD5 Generator, SHA-256 Generator, and SHA-512 Generator when testing known inputs.

What this tool does

Pattern	Detection result
32 hex chars	Likely MD5 (128-bit)
40 hex chars	Likely SHA-1 (160-bit)
64 hex chars	Likely SHA-256 (256-bit)
128 hex chars	Likely SHA-512 (512-bit)
Starts $2a$ or $2b$	Likely bcrypt
Starts $argon2	Likely Argon2
Other	Unknown format — check length and prefix

Case-insensitive hex matching. Whitespace trimmed. No entropy analysis or rainbow table lookup.

How it works

export function detectHashType(hash: string): string {
  const h = hash.trim();
  if (/^[a-f0-9]{32}$/i.test(h)) return "Likely MD5 (128-bit)";
  if (/^[a-f0-9]{40}$/i.test(h)) return "Likely SHA-1 (160-bit)";
  if (/^[a-f0-9]{64}$/i.test(h)) return "Likely SHA-256 (256-bit)";
  if (/^[a-f0-9]{128}$/i.test(h)) return "Likely SHA-512 (512-bit)";
  if (h.startsWith("$2a$") || h.startsWith("$2b$")) return "Likely bcrypt";
  if (h.startsWith("$argon2")) return "Likely Argon2";
  return "Unknown format — check length and prefix";
}

Collisions exist — 64 hex could be SHA-256 or truncated other digests. Labels say "Likely" intentionally.

Real-world examples

Legacy app migration audit

Identify MD5 password columns requiring urgent upgrade to bcrypt — detector flags 32-char hex before writing migration RFC.

CTF and coursework

Students classify provided digests before attempting crack strategies — discuss why MD5 is fast versus bcrypt work factor.

Log correlation

API returns fingerprint — 64 hex suggests SHA-256 HMAC output; compare generation with HMAC SHA256 Generator.

Distinguishing random hex from hashes

Random Bytes Generator output length varies; fixed lengths hint algorithm class.

Incident response tabletop

Analysts practice labeling sample redacted hashes without sending data externally — reinforce local-only tooling discipline.

Common mistakes

Treating "Likely" as definitive. Length collisions and encoding variations fool heuristics — confirm with system documentation.

Identifying salted versus unsalted MD5. Detector sees length only — cannot know if salt appended outside hex representation.

Expecting PBKDF2 or scrypt detection. Not in current prefix list — may show unknown.

Pasting live user password hashes into cloud tools. Certoflow is local; habit formation matters — use synthetic samples.

Confusing hex-encoded binary with base64 digests. Base64 lengths differ — detector expects hex or known prefixes.

Using for legal evidence. Heuristic tool not certified forensic instrument.

Use cases

Security engineers scoping password hash upgrades.

Developers debugging which algorithm their library outputs.

Educators teaching hash format recognition.

CTF participants quick classification step.

Database administrators inventorying column types in legacy schemas.

Compliance auditors documenting hash algorithm findings at high level.

FAQ

Definitive identification?

No. Heuristic based on length and prefix patterns.

bcrypt variants?

Detects $2a$ and $2b$ prefixes.

Argon2 variants?

Any string starting $argon2.

Hex case sensitivity?

Case-insensitive matching.

Base64 hashes?

Not detected — convert or inspect manually.

Empty input?

No result until hash provided.

Local processing?

Yes.

Generate test hashes?

MD5 Generator, SHA-256 Generator, SHA-512 Generator.

HMAC versus plain hash?

Same length as underlying hash — context determines interpretation.

Offline?

Yes.

Responsible hash identification

Hash type detection supports education and engineering triage — not cracking passwords. When you identify MD5 in a legacy users table, the remediation is rehashing on next login with bcrypt or Argon2, not attempting reversal. When you see 64 hex characters in API logs, distinguish HMAC-SHA256 outputs (keyed, verifies integrity) from plain SHA-256 fingerprints (often file checksums) by application context — the detector cannot tell. bcrypt strings embed cost factor in the prefix ($2b$10$...); upgrading cost does not change the algorithm label. Pair identification with generation tools: hash a known test password with SHA-256 Generator and compare length to mystery digests. For compliance questionnaires asking "which hash algorithm stores passwords," paste redacted sample format here, document "Likely bcrypt," and verify against application source code — heuristics supplement but never replace authoritative documentation from the development team responsible for the auth module.