Treat display length as a filter
A digest is a byte sequence commonly displayed in hexadecimal or Base64. Hex uses two characters per byte, so a 128-bit MD5 digest appears as 32 hex characters, SHA-1 as 40, SHA-256 as 64, and SHA-512 as 128. That narrows possibilities but does not uniquely identify an algorithm. Truncation, concatenation, and unrelated identifiers can share the same shape.
| Candidate | Common hex length | Modern use |
|---|---|---|
| MD5 | 32 | Legacy matching; not collision-resistant |
| SHA-1 | 40 | Legacy identifiers; not collision-resistant |
| SHA-256 | 64 | Integrity and content identity |
| SHA-512 | 128 | Integrity and cryptographic protocols |
Use structured prefixes
Password hashes often include an algorithm marker, cost, salt, and digest in one encoded string. Prefixes such as $2b$ for bcrypt or $argon2id$ for Argon2id carry more information than raw length. Do not remove punctuation to force them into a generic hex pattern. The parameters are part of the stored verification record.
A raw digest cannot reveal whether the input was salted, transformed, or combined with other fields. Context from a challenge description, file manifest, protocol, or database schema is essential.
Verify a hypothesis with known input
For the ASCII text abc, SHA-256 produces:
ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015adThe actual digest contains 64 continuous hex characters. Calculate the candidate algorithm over the exact bytes and compare the complete result. A trailing newline, UTF-16 encoding, or uppercase/lowercase normalization changes the input bytes and therefore the digest.
Separate identification from security
Recognizing MD5 does not mean “decrypting” it is possible. Hashes are one-way functions. Weak or predictable inputs may be guessed and compared, but that is different from reversing a digest. MD5 and SHA-1 have known collision weaknesses and should not protect new integrity or signature designs. General-purpose SHA-256 is also not a password-storage function; password storage needs a salted, deliberately expensive construction such as Argon2id, scrypt, bcrypt, or PBKDF2 under an appropriate policy.
Only test password hashes from CTFs, training data, or systems you are explicitly authorized to assess. Do not upload real credential material to public lookup services.
Common mistakes
Matching by length alone
A 32-character hex value might be MD5, a random identifier, or two concatenated 64-bit values. Record it as “MD5-shaped” until other evidence confirms the algorithm.
Ignoring representation
The same digest can be printed as hex, Base64, or raw bytes. A 44-character Base64 value may represent 32 bytes, including padding.
Comparing incomplete values
Short prefixes are useful labels but weak integrity checks. Store and compare the complete digest when evidence identity matters.
How this guide was verified
MD5, SHA-1, SHA-256, and SHA-512 examples were checked against published standard vectors and browser or command-line implementations. Tests included empty input, ASCII abc, a trailing newline, and multibyte UTF-8. Password-hash prefixes were treated only as format indicators; no password-cracking claim is made.
Identification checklist
- Preserve the complete original string.
- Record alphabet, length, separators, and prefixes.
- List candidates without declaring a winner.
- Find contextual evidence for the algorithm and input format.
- Calculate a known-input vector where possible.
- State what the match proves and what it does not.