Hash Identifier & Auditor Pro
Paste a stored password hash to find out what type it is and how strong its settings are. You can then check whether one specific password produces it, or run a list of weak passwords against it to see if it protects a guessable one. Free preview · Pro required to export. Identify and verify hashes free, and audit against the 50 most common passwords. Pro runs the full list and your own wordlist.
Free preview · Pro required to export. Identify and verify hashes free, and audit against the 50 most common passwords. Pro runs the full list and your own wordlist.
Why use this tool?
- A database dump or a user table shows long strings of characters. Knowing whether one is bcrypt, SHA-256 or something older tells you how well the passwords behind it are protected.
- A bcrypt hash carries its cost setting inside the string. Reading it shows at a glance whether it was created with a modern setting.
- An audit is how you find accounts using passwords such as "password123" and force a reset, without needing anyone's real password.
- Everything is done on your own device, so a sensitive hash does not have to be pasted into someone else's server.
How to use Hash Identifier & Auditor
- Paste the full hash into "Paste a password hash", including the leading $ signs. Or press "Load an example" to see a working demonstration.
- Read the type and, for bcrypt, the cost factor. A notice rates the cost as strong, acceptable or low.
- To test one password, type it into "Candidate password" and press "Verify". You will see Match or No match.
- To audit, keep the built-in common-password list ticked, or add your own words, one per line, under "Your own wordlist". Press "Run audit".
- Watch the "Tested" counter. The audit stops at the first match and shows the weak password, or reports that nothing in the list matched. "Stop" cancels a run early.
Features
- Recognises bcrypt, Argon2, MD5 or NTLM, SHA-1, SHA-256, SHA-384 and SHA-512 by their shape
- Reads the bcrypt cost factor and rates it: below 10 is low, 10 to 11 is acceptable, 12 and above is strong
- Flags a bcrypt-looking string that is the wrong length, which usually means a truncated copy
- Verifies a password against bcrypt and SHA-1, SHA-256, SHA-384 and SHA-512 hashes
- Weak-password audit using a built-in list of common passwords and your own wordlist
- A progress counter and a Stop button, so a slow bcrypt run never freezes the page
- Runs entirely in the browser using the bcryptjs library and the browser's own cryptography
Supported formats
Input is a hash string, a candidate password and an optional wordlist of one password per line. Output is a hash type, a cost rating, a Match result and an audit verdict, shown on screen only.
Tips
- bcrypt is slow on purpose, so a long wordlist at a high cost takes noticeable time. Use the Stop button if you only wanted a quick check.
- Paste the whole hash, with no spaces or quotes. A shortened or wrapped hash is reported as unrecognised or malformed.
- MD5 and Argon2 are identified only. The tool does not verify them, so the Verify and Run audit buttons stay greyed out.
- A "Held" result means only that none of the words in your list matched. It does not prove the password is strong.
Frequently asked questions
Can this reverse a hash back into the password?
No. Hashes are one-way. A password is only found here if it appears in the wordlist, which is how a real password audit works.
Are the hashes or passwords sent to a server?
No. Comparison runs in your browser, and neither the hash nor any password you type is uploaded.
Why can it not verify MD5 or Argon2?
The tool can recognise both by shape, but its verification covers only bcrypt and the SHA family. Argon2 checking needs a server-side library.
What does the bcrypt cost number mean?
The cost is the exponent for how many rounds the hash used, so cost 12 means 2 to the power of 12 rounds. Each extra step doubles the work needed to test a guess.
Why is a 32-character hash labelled MD5 or NTLM?
Both produce 32 hexadecimal characters, so the shape alone cannot tell them apart. Both are fast and unsalted, and neither is suitable for storing passwords.
Should I use this on other people's hashes?
It is meant for your own accounts and databases. Only audit hashes you have the right to check.
Can I try this Pro tool without an account?
Yes. Identify and verify hashes free, and audit against the 50 most common passwords. Pro runs the full list and your own wordlist. Your own input is processed locally in your browser.
Will upgrading keep my work?
Checkout and login open in a separate tab. Keep the workspace open to retain inputs, settings and previews. Files stay in that tab only; keep the originals in case you close or reload it. Export access is checked with the server after payment.
Your files are processed directly in your browser and are not uploaded to HubToolify's servers.