Softonic

Encryption Identifier

Step 1 / 2
Identify Format

You scraped a database dump and see strings like $2y$10$... or 5f4dcc3b5aa765d61d8327deb882cf99 and need to know what you are looking at before you start cracking or reversing. This identifier applies length, charset, structure and prefix heuristics to guess the most likely algorithm or encoding behind a ciphertext sample.

How to identify a ciphertext

  1. 1

    Paste the sample

    A single hash, ciphertext blob, token or encoded string.

  2. 2

    See the matching formats

    Every format whose pattern matches your sample is listed in the result.

  3. 3

    Cross-check

    If several formats match, use a hash cracker or decoder to confirm which one is correct.

  4. 4

    Note uncertainty

    Identification from a sample alone is rarely definitive; if nothing matches, the tool says so.

Signature patterns the identifier uses

Length-based (for hex-encoded hashes):

Length (hex chars) Identified as
32 MD5
40 SHA-1
64 SHA-256
128 SHA-512

Other lengths, such as SHA-224 at 56 hex chars or SHA-384 at 96, are not recognized as hashes (a 56- or 96-character hex string is classified as Base64-like instead).

Prefix-based (only bcrypt prefixes are matched):

  • $2a$ $2b$ $2y$ bcrypt

Other crypt-style prefixes ($1$, $5$, $6$, $argon2i$, $argon2id$, $pbkdf2$) are not matched.

Encoding-based:

  • All characters in [A-Za-z0-9+/=] and length a multiple of 4: Base64-like.
  • Three segments split by ., each using [A-Za-z0-9_-]: JWT.

PEM wrappers, OpenSSH ssh-rsa/ssh-ed25519 blobs and Base64url strings that contain - or _ are not detected.

What identification cannot tell you

  • Exact algorithm with 100% certainty. A 64-hex-character string is reported as SHA-256, but it could also be SHA3-256 or BLAKE2s; they are indistinguishable by ciphertext. NTLM hashes (also 32 hex chars) look identical to MD5.
  • Key strength. A bcrypt hash shows the cost factor in its prefix ($2y$10$ = cost 10), but not the underlying password strength.
  • Whether it is salted. Modern password hashes (bcrypt, Argon2) are always salted; old ones (raw MD5/SHA) might or might not be.
  • The plaintext. Identification does not reverse the hash; cracking is a separate process, legal only on your own data.

When the identifier is wrong

  • Custom-prefixed tokens. Apps sometimes wrap a hash with their own prefix; strip the wrapper first.
  • Double encoding. Base64-wrapped hex of a binary hash will misidentify. Try decoding once and re-running.
  • Unusual lengths. Truncated hashes (first 16 chars of SHA-256 used as an ID) come back as “Base64-like” because the charset and length rules overlap.
  • Framed or wrapped formats. PEM blocks, OpenSSH keys and Django’s pbkdf2_sha256$... do not match; strip the wrapper or prefix and try again, or use a dedicated parser.

Use cases

  • Security audits: cataloging hash types across a codebase before a crypto migration.
  • CTF challenges: quick first pass at an unknown blob.
  • Incident response: identifying leaked credential format.
  • Framework debugging: figuring out what encoding a library produces.

Ethics reminder

Identifying a hash format is passive research. Cracking someone else’s hash without authorization violates computer misuse laws in most jurisdictions. Only work on hashes you own or are authorized to analyze.

Frequently Asked Questions

Partially: MD5 is 32 hex chars, SHA-1 is 40. If both are the same length range, you cannot distinguish by the hash alone. Context (database column name, framework defaults, leaked schema) usually settles it.

No. It only identifies. Reversing a hash or decrypting a ciphertext requires separate tools (and the key, or computational resources for cracking) and is legal only on your own material.

Argon2id (or bcrypt at high cost factor) is the current recommendation. PBKDF2-SHA256 and scrypt remain acceptable. Plain MD5, SHA-1 or unsalted SHA-256 are not safe for password storage.

No. The value you paste is sent to our server for the format check, but it is not stored in any database and is not added to the page link.

Related Tools

A1Z26 Cipher Encoder

Encode text using the A1Z26 cipher (A=1, B=2, ... Z=26) or decode a number sequence back to letters, with customizable separator.

Base64 File Encoder

Encode any file (PDF, ZIP, image, executable) to Base64 text for embedding in JSON, email, YAML or data URIs. Runs locally, no upload.

Atbash Cipher Encoder

Encode or decode text with the Atbash cipher, a Hebrew substitution that maps A-Z to Z-A. Same operation encrypts and decrypts.

AES Encrypt / Decrypt

Encrypt and decrypt low-risk text with AES OpenSSL ciphers. The passphrase is hashed with SHA-256 and the Base64 output is IV plus ciphertext.

Caesar Cipher Encoder

Encrypt and decrypt text using the Caesar cipher. Any shift 1-25, supports ROT13 as a special case, preserves punctuation and case.

Cipher Identifier

Paste ciphertext and the identifier suggests likely encoding/cipher schemes: Base64, hex, binary, Morse, Caesar or substitution, JWT and common hashes.

Tool available in other languages