Hash Type Detector
Paste a hash string or output from zip2john / office2john / pdf2john — the format is identified locally, with the corresponding Hashcat mode number. Nothing is uploaded.
How detection works
The detector first checks for explicit format prefixes — $pkzip2$, $office$, $oldoffice$, etc. These are unambiguous markers that the John the Ripper / Hashcat ecosystem uses. When present, format identification is high-confidence.
For raw hex strings without prefixes, length is the primary signal: 32 hex chars suggests MD5 / NTLM / MD4; 40 chars suggests SHA-1; 64 chars suggests SHA-256. These are medium-confidence guesses because multiple algorithms share lengths.
Base64 encoding, colon-separated pairs (user:hash), and other structural hints provide low-confidence fallback signals. When in doubt, the Hashcat documentation has example hashes for every supported mode.
Common Hashcat modes for file recovery
Have an actual encrypted file to recover?
Skip the manual hash extraction — upload the file directly, format is detected automatically, free analysis runs first.
Run Free Analysis