Hash Identifier

A digest is a fixed-length number. It carries no header, no label and no record of what produced it, which means identification is inference from shape — and the honest output is a list, not an answer.

Length narrows; it rarely decides

Thirty-two hex digits is MD5. It is also NTLM, MD4, and half an LM hash. Those are the same 128 bits and nothing inside the value separates them — only knowing where it came from does. A hash pulled from a domain controller dump is NTLM; the same string in a file manifest is not. So every candidate at a given length is listed, with the most frequent marked likely on grounds of frequency rather than evidence.

Some hashes do name themselves

A modular-crypt string says what it is in the prefix: $2b$ is bcrypt, $argon2id$ is Argon2, $6$ is sha512crypt, $y$ is yescrypt. A MySQL 4.1 hash is marked by a leading asterisk. These come back as a single answer because they were read rather than inferred, and bcrypt's cost factor sits right there in the string.

Nothing is looked up

No rainbow table, no cracking, no outbound request. Pasting a hash here does not disclose it to anyone — which is the point, because a hash taken from an incident is frequently the most sensitive value an analyst is holding.

900150983cd24fb0d6963f7d28e17f72 returns MD5, NTLM, MD4 and LM — all four, because all four fit. $2b$12$… returns bcrypt alone, with the cost factor of 12 read straight out of the string.