PAGES
← all tools
◆ Password & Credential Cracking

name-that-hash

1.11.0 open-source

Name-That-Hash identifies hash types, displaying the most popular hashes first with summaries of each hash's main usage.

source ↗ rss ↗ What is a cyber toolchain?

Summary

name-that-hash is an open-source command-line tool that identifies what type of hash a given string is, ranking candidates like MD5, MD4, NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent., or Domain Cached Credentials by popularity and pointing to the matching Hashcat or John the Ripper mode. It installs via pip and runs as a CLI, with a hosted web app available for anyone who doesn't want to install anything, and it can also be imported as a Python module or driven through JSON output for scripting. It's aimed at people doing password cracking or forensic work who need to figure out a hash before feeding it to a cracker. Its README compares it directly to HashID and Hash-Identifier, positioning itself as the actively maintained alternative to those older, largely abandoned tools. First committed in 2021 with 30 contributors and ten tracked releases, though there have been no commits in the past year.

Name-That-Hash identifies hash types, displaying the most popular hashes first with summaries of each hash's main usage.

How name-that-hash helps

What type of algorithm produced this string sitting in my notes?

ranks the likely candidates from MD5 up through MD4, NTLM, and Domain Cached Credentials, ordered by real-world popularity rather than treating every hash type as equally likely

Which mode do I pass to my cracker for this value?

names the matching Hashcat mode number and John the Ripper format alongside each candidate, so the value can go straight into a cracking run

Is this string even a hash, or just part of a larger blob of text?

can search within a longer string and pull out the embedded hash rather than requiring the input to be nothing but the hash itself

Can I tell what a hash is without sending it to an external service?

runs the identification locally from the command line or as an imported module, so the value never has to leave the machine it was found on

How do I check hundreds of extracted hashes from a breach dump without eyeballing each one?

accepts a JSON-driven workflow so results can be scripted and reviewed in bulk instead of one string at a time

Which few algorithms should I actually try first when a hash could be dozens of things?

separates a short list of most-likely types from a long tail of low-probability matches, so effort goes to the candidates worth testing first

Languages

Not documented

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for name-that-hash, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail name-that-hash puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

6 entries

  1. November 20221
  3. May 20212
  6. April 20211
  8. March 20211
  10. February 20211

    6 entries

    1. 1.11.0 Nov 17, 2022 · release notes

      Adds BitLockerBitLockerA full-disk encryption feature built into Windows, maintained by Microsoft, that protects data at rest by encrypting entire volumes; cyber tools use it to audit encryption status or recover keys from managed endpoints. and RACF hash types plus yescrypt regex support.

      └──▷ GET THIS VERSION 
      $ git clone --branch 1.11.0 https://github.com/HashPals/Name-That-Hash.git
# already have the repo? check out this version:
$ git checkout 1.11.0
      • name-that-hash now identifies BitLocker and RACF hash formats
      • name-that-hash adds recognition for the yescrypt hash algorithm
      • name-that-hash supports identifying hashes using Argon2i and argon2d modes compatible with john

      3 details in Everything

    2. 1.9.0 May 22, 2021 · release notes

      name-that-hash 1.9.0 adds a popular() API function and supports PDF/7-zip/SecureZIP hash types

      └──▷ GET THIS VERSION 
      $ git clone --branch 1.9.0 https://github.com/HashPals/Name-That-Hash.git
# already have the repo? check out this version:
$ git checkout 1.9.0
      └──▷ TRY IT
      Identify a hash generated from a PDF document.
      $ nth "5d41402abc4b2a76b9719d911017c592" --verbose
      Identify a hash generated from a 7-zip archive.
      $ nth "d8590ed7ce1364c34a67d3f7186e2677" --verbose
    3. 1.8.0 May 1, 2021 · release notes

      Adds MS Office <= 2003, Blake2b-512, and Telegram Mobile App Passcode hash detection

      └──▷ GET THIS VERSION 
      $ git clone --branch 1.8.0 https://github.com/HashPals/Name-That-Hash.git
# already have the repo? check out this version:
$ git checkout 1.8.0
      • Added MS Office <= 2003 hash detection to the supported types.
      • Added Blake2b-512 hash detection to the supported types.
      • Added Telegram Mobile App Passcode hash detection to the supported types.

      3 details in Everything

    4. 1.7.0 Apr 19, 2021 · release notes

      name-that-hash 1.7.0 adds support for Blake2b-256, WinZip, iTunes, Android Backup, and Electrum Bitcoin wallet hash types.

      └──▷ GET THIS VERSION 
      $ git clone --branch 1.7.0 https://github.com/HashPals/Name-That-Hash.git
# already have the repo? check out this version:
$ git checkout 1.7.0
      • Adds blake2b256 hash type detection
      • Adds winzip hash type detection
      • Adds itunes hash type detection
      • Adds android_backup hash type detection
      • Adds electrum_btc_seed, electrum_btc_wif, and electrum_btc_address hash type detections

      5 details in Everything

    5. 1.6.0 Mar 20, 2021 · release notes

      Adds cryptocurrency hash detection and improves KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. output formatting in v1.6.0

      └──▷ GET THIS VERSION 
      $ git clone --branch 1.6.0 https://github.com/HashPals/Name-That-Hash.git
# already have the repo? check out this version:
$ git checkout 1.6.0
      • Improved Kerberos hash types separation into salt and without a salt variants (#72)

      1 detail in Everything

    6. 1.0.0 Feb 10, 2021 · release notes

      Adds base64 decoding support for hash identification

      └──▷ GET THIS VERSION 
      $ git clone --branch 1.0.0 https://github.com/HashPals/Name-That-Hash.git
# already have the repo? check out this version:
$ git checkout 1.0.0
      └──▷ TRY IT
      Decode a base64-encoded string to identify the underlying hash type.
      $ name-that-hash <base64_encoded_string>
      • Supports base64 input format for hash analysis

      1 detail in Everything

    Project health

    Issue, contributor and maintainer activity in HashPals/Name-That-Hash, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 0 ±0 vs prior 12 months
    2. Maintainers 0 +0 joined · −0 left, last 12 months
    3. Bus factor 0 committers behind half the commits
    4. Community-filed not measured of issues opened, last 12 months
    5. Median time to close not measured issues closed, last 12 months
    6. Open backlog not measured open issues today
    1. Issues opened / month not measured
    2. Open backlog not measured
    3. Contributors / month 0
    4. Commits / month 0
    5. Stars 1,668
    Issue themes, last 12 months not measured

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Libraries its release ships

    What its latest release locks, checked against known advisories.

    None of its release's images build from a lockfile we can read.

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    compare.md

      Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

      my-toolchain — 0 tools

        Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
        browse all tools → score card for your toolchain →
        cyber-toolchain / feedback

        Send us feedback