Hash type reference
Browse every format the identifier recognises. Each page has the hashcat mode, the John the Ripper format, and copy-paste crack commands.
Raw & unsalted hashes
- MD5-m 0
A 128-bit MD5 message digest shown as 32 hexadecimal characters. Fast, unsalted, and cryptographically broken — trivially crackable with a GPU.
- SHA-1-m 100
A 160-bit SHA-1 digest as 40 hex characters. Deprecated for security use; unsalted and fast to brute-force.
- SHA-256-m 1400
A 256-bit SHA-2 digest as 64 hex characters. Strong as a digest but, when unsalted, still brute-forceable for weak passwords.
- SHA-512-m 1700
A 512-bit SHA-2 digest, 128 hex characters. Strong digest; unsalted variants still fall to wordlists.
- md5($pass.$salt)-m 10
Salted MD5 in the form hash:salt, with the salt appended to the password before hashing.
- md5($salt.$pass)-m 20
Salted MD5 with the salt prepended to the password. Stored as hash:salt.
- sha1($pass.$salt)-m 110
Salted SHA-1 with the salt appended to the password, stored as hash:salt.
- MD4-m 900
The 128-bit MD4 digest. Obsolete and even weaker than MD5; survives mainly inside NTLM.
- sha256($pass.$salt)-m 1410
Salted SHA-256 with the salt appended to the password, stored as hash:salt.
- Double MD5 — md5(md5($pass))-m 2600
MD5 applied twice. Common in older PHP apps; offers no real protection over single MD5.
- SHA-224-m 1300
A 224-bit truncated SHA-2 digest, 56 hex characters. Unsalted.
- SHA-384-m 10800
A 384-bit truncated SHA-2 digest, 96 hex characters.
- Double SHA-1 — sha1(sha1($pass))-m 4500
SHA-1 applied twice. Found in some legacy web apps; barely harder than single SHA-1.
- HMAC-SHA1 (key = $salt)-m 160
An HMAC-SHA1 message authentication code with the salt as the key.
- SHA3-256 / Keccak-256-m 17400
A 256-bit SHA-3/Keccak digest. Used in Ethereum and modern protocols.
- BLAKE2b-512-m 600
A BLAKE2b-512 digest with the $BLAKE2$ prefix. Fast modern hash.
- Double SHA-256-m 1420
SHA-256 applied twice; appears in some apps and blockchain contexts.
- Half MD5 (first 64 bits)-m 5100
The first 16 hex characters of an MD5 digest. Same length as MySQL323 and Oracle DES hashes.
- RIPEMD-160-m 6000
A 160-bit RIPEMD digest. Used in some crypto/Bitcoin contexts; rendered as 40 hex characters.
- SHA3-512-m 17600
A 512-bit SHA-3 digest, 128 hex characters.
- sha512($pass.$salt)-m 1710
Salted SHA-512 with the salt appended to the password, stored as hash:salt.
- Whirlpool-m 6100
A 512-bit Whirlpool digest, 128 hex characters — same length as SHA-512.
- Keccak-256-m 17800
A 256-bit Keccak digest (used by Ethereum), 64 hex characters — same length as SHA-256.
- GOST R 34.11-94-m 6900
The Russian GOST 34.11-94 hash, 64 hex characters — same length as SHA-256.
- Keccak-512-m 18000
A 512-bit Keccak digest, 128 hex characters — same length as SHA-512/Whirlpool.
- SHA3-224-m 17300
A 224-bit SHA-3 digest, 56 hex characters — same length as SHA-224.
- SHA3-384-m 17500
A 384-bit SHA-3 digest, 96 hex characters — same length as SHA-384.
- Tiger-192
A 192-bit Tiger digest, 48 hex characters.
- md5(sha1($pass))-m 4400
Nested md5(sha1($pass)), 32 hex characters — same length as plain MD5.
- RIPEMD-128
A 128-bit RIPEMD digest, 32 hex characters — same length as MD5/NTLM.
- sha1(md5($pass))-m 4700
Nested sha1(md5($pass)), 40 hex characters — same length as plain SHA-1.
- sha384($pass.$salt)-m 10810
Salted SHA-384 with the salt appended to the password, stored as hash:salt.
- Streebog-256 (GOST 2012)-m 11700
The 256-bit Russian GOST R 34.11-2012 (Streebog) digest, 64 hex characters.
- Streebog-512 (GOST 2012)-m 11800
The 512-bit Russian GOST R 34.11-2012 (Streebog) digest, 128 hex characters.
- Keccak-224-m 17700
A 224-bit Keccak digest (pre-standard SHA-3), 56 hex characters.
- Keccak-384-m 17900
A 384-bit Keccak digest (pre-standard SHA-3), 96 hex characters.
- MD2
An obsolete 128-bit MD2 digest, 32 hex characters. Cryptographically broken.
Windows credentials
- NTLM-m 1000
The NTLM hash Windows stores for local and domain accounts. Unsalted MD4 of the UTF-16 password — recovered fast on GPUs and replayable via pass-the-hash.
- LM (LAN Manager)-m 3000
Legacy Windows LAN Manager hash. Uppercases the password and splits it into two 7-char halves — crackable in seconds.
- Domain Cached Credentials 2 (DCC2/MS-Cache v2)-m 2100
Cached domain logon credentials from a Windows machine (PBKDF2 over the NTLM hash). Slow to crack.
- Domain Cached Credentials (DCC/MS-Cache v1)-m 1100
Legacy Windows cached domain credentials (MS-Cache v1), salted with the username and stored as hash:username. Fast to crack.
- DPAPI masterkey v1-m 15300
A Windows DPAPI master key (pre-Win10 1607). Recover the user's logon password offline.
- DPAPI masterkey v2-m 15310
A Windows DPAPI master key (Win10 1607+). Recover the user's logon password offline.
Databases
- MySQL 4.1+ / SHA1(SHA1())-m 300
MySQL 4.1+ password hash: SHA1(SHA1(pass)) prefixed with '*'. Unsalted and GPU-friendly.
- PostgreSQL MD5-m 12
PostgreSQL stores md5(password + username) prefixed with 'md5'. The username is the salt.
- MSSQL (2012/2014)-m 1731
Microsoft SQL Server 2012+ password hash — salted SHA-512.
- MSSQL (2005)-m 132
Microsoft SQL Server 2005 password hash — salted SHA-1.
- MySQL 3.23 (pre-4.1)-m 200
The 16-hex-character hash from MySQL ≤ 4.0. Weak proprietary algorithm, broken in milliseconds.
- Oracle 11g (SHA-1)-m 112
Oracle 11g password hash — salted SHA-1 with the 'S:' prefix.
- PostgreSQL SCRAM-SHA-256-m 28600
The modern PostgreSQL (10+) SCRAM-SHA-256 credential. Iterated PBKDF2 — slower than the legacy md5 scheme.
- MSSQL (2000)-m 131
Microsoft SQL Server 2000 password hash (case-sensitive + case-insensitive SHA-1).
- MongoDB SCRAM-SHA-1-m 24100
MongoDB SCRAM-SHA-1 credential. Iterated PBKDF2-style; crackable offline.
- Oracle 7-10g (DES)-m 3100
Oracle 7–10g password hash based on DES; the username acts as the salt.
- Sybase ASE-m 8000
A Sybase ASE 15+ password hash (salted SHA-256) with a 0xc007 prefix.
Network authentication
- NetNTLMv2-m 5600
NetNTLMv2 challenge/response captured from SMB/LDAP auth (e.g. via Responder). Crackable offline with a wordlist.
- Kerberos 5 TGS-REP (etype 23, Kerberoast)-m 13100
A Kerberoast ticket (TGS-REP, RC4/etype 23) dumped from Active Directory. Crack it offline to recover the service account password.
- WPA/WPA2 EAPOL handshake (22000)-m 22000
A WPA/WPA2 4-way handshake in the hashcat 22000 (hcxtools) format. Offline dictionary attack against the Wi-Fi PSK.
- WPA/WPA2 PMKID (hashcat 22000)-m 22000
A WPA/WPA2 PMKID captured from a Wi-Fi access point. Crack the PSK offline with a wordlist.
- Kerberos 5 AS-REP (etype 23, AS-REP roast)-m 18200
An AS-REP for an account with pre-auth disabled. Crackable offline to recover the user's password.
- Cisco IOS type 7
Cisco IOS type 7 'encryption' — a trivially reversible Vigenère cipher, not a hash. Decode instantly with any type-7 tool.
- Cisco IOS type 5 (md5crypt)-m 500
Cisco IOS type 5 secret — identical to Unix md5crypt.
- NetNTLMv1-m 5500
NetNTLMv1 challenge/response. Weaker than v2 and downgradeable to DES brute force.
- Kerberos 5 AS-REQ Pre-Auth (etype 23)-m 7500
A Kerberos AS-REQ pre-authentication timestamp captured from the wire. Crack offline for the user's password.
- Cisco IOS type 8 (PBKDF2-SHA256)-m 9200
Cisco IOS type 8 secret based on PBKDF2-HMAC-SHA256.
- Cisco IOS type 9 (scrypt)-m 9300
Cisco IOS type 9 secret based on the memory-hard scrypt KDF — very slow to crack.
- Kerberos 5 etype 17/18 (TGS, AES)-m 19600
AES-based Kerberos TGS ticket (etype 17/18). Much slower to crack than RC4 etype 23.
- IPMI2 RAKP HMAC-SHA1-m 7300
An IPMI 2.0 RAKP HMAC-SHA1 hash dumped from a BMC (server lights-out controller). Crackable offline; BMCs often ship weak default passwords.
- MD5(CHAP) / iSCSI CHAP-m 4800
An MD5 CHAP challenge/response (PPP, iSCSI): response:challenge:id. Crack offline for the secret.
- FortiGate (FortiOS)-m 7000
A FortiGate/FortiOS administrator password hash (salted SHA-1 with an AK1 prefix).
- SIP digest authentication-m 11400
A captured SIP (VoIP) digest authentication challenge/response. Crack offline for the SIP password.
- SNMPv3 HMAC-m 25100
A captured SNMPv3 HMAC authentication packet. Crack offline for the SNMP auth password.
- IPsec IKE PSK (aggressive mode)-m 5300
An IPsec IKE aggressive-mode PSK handshake (colon-separated hex fields). Use hashcat -m 5300 for MD5 or -m 5400 for SHA1.
- CRAM-MD5-m 10200
A captured CRAM-MD5 (SMTP/IMAP/POP) authentication exchange. Crack offline for the mailbox password.
Key-derivation functions
- bcrypt-m 3200
A bcrypt/Blowfish password hash with a tunable cost factor. Deliberately slow — only short or weak passwords are realistically crackable.
- PBKDF2-HMAC-SHA256 (Django)-m 10000
Django's default PBKDF2-HMAC-SHA256 password hash with a high iteration count. Slow to crack by design.
- Argon2-m 34000
The modern, memory-hard Argon2 KDF (winner of the Password Hashing Competition). Extremely resistant to GPU cracking.
- PBKDF2-HMAC-SHA512-m 7100
PBKDF2 with HMAC-SHA512. Used by macOS and various password managers; tunable iterations.
- scrypt-m 8900
The memory-hard scrypt KDF. Resistant to GPU/ASIC cracking by design.
- PBKDF2-HMAC-SHA1-m 12000
PBKDF2 with HMAC-SHA1 (sha1:iterations:salt:hash). Tunable iterations make it slow.
- PBKDF2-HMAC-MD5-m 11900
PBKDF2 with HMAC-MD5 (md5:iterations:salt:hash).
Unix crypt
- sha512crypt ($6$)-m 1800
The default Linux /etc/shadow hashing scheme (SHA-512 crypt). Salted with thousands of rounds — slow to crack.
- md5crypt ($1$)-m 500
The FreeBSD/Linux md5crypt scheme (1000 MD5 iterations). Salted and slower than raw MD5 but still weak by modern standards.
- sha256crypt ($5$)-m 7400
The SHA-256 crypt(3) scheme used in /etc/shadow. Salted with configurable rounds.
- descrypt (traditional DES crypt)-m 1500
The classic 13-character DES crypt(3) hash. Limited to 8 significant password characters; weak by design.
- yescrypt ($y$)
The modern default /etc/shadow scheme on recent Linux (Debian 11+, Fedora). Memory-hard and very slow to attack.
- AIX {smd5}-m 6300
An AIX salted-MD5 ({smd5}) password hash — md5crypt under the hood.
- AIX {ssha1}-m 6700
An AIX salted-SHA1 ({ssha1}) password hash with an iteration count.
- AIX {ssha256}-m 6400
An AIX salted-SHA256 ({ssha256}) password hash with an iteration count.
- AIX {ssha512}-m 6500
An AIX salted-SHA512 ({ssha512}) password hash with an iteration count.
- bsdicrypt ($J9$ / _ )-m 12400
BSDi extended DES crypt with a variable iteration count.
- macOS 10.4–10.6 (salted SHA-1)-m 122
A macOS 10.4–10.6 password hash: salted SHA-1, 48 hex characters (8 hex salt + 40 hex digest).
- macOS 10.7 (salted SHA-512)-m 1722
A macOS 10.7 Lion password hash: salted SHA-512, 136 hex characters (8 hex salt + 128 hex digest).
Applications & CMS
- phpass (WordPress / Drupal / phpBB)-m 400
The portable phpass hash used by WordPress ($P$) and phpBB3 ($H$). Iterated MD5 — slower than raw MD5 but still crackable.
- Apache md5apr1 ($apr1$)-m 1600
Apache's md5crypt variant used in .htpasswd files.
- SSH private key-m 22911
An encrypted OpenSSH/PEM private key. Crack the key passphrase offline; mode varies by key type.
- Drupal 7 ($S$)-m 7900
Drupal 7's SHA-512-based phpass variant with many iterations.
- LDAP {SSHA} (salted SHA-1)-m 111
Base64-encoded salted SHA-1 ({SSHA}) — the default OpenLDAP password scheme.
- Django (SHA-1)-m 124
Legacy Django SHA-1 password hash in algorithm$salt$hash form.
- GPG / OpenPGP private key-m 17010
A passphrase-protected GnuPG/OpenPGP secret key. Recover the key passphrase offline.
- Joomla (md5:salt)-m 11
Joomla legacy password: MD5 of the password concatenated with a salt, stored as hash:salt.
- KeePass 1/2-m 13400
A KeePass database master-key hash. High iteration count makes brute force slow.
- LDAP {SHA} (Netscape)-m 101
Base64-encoded unsalted SHA-1 with a {SHA} prefix, used by LDAP/Netscape directories.
- Ansible Vault-m 16900
An Ansible Vault encrypted secret (PBKDF2-HMAC-SHA256 + AES-256). Crack the vault password offline.
- Bitwarden-m 23400
A Bitwarden password-manager vault (PBKDF2-HMAC-SHA256). Recover the master password offline.
- macOS keychain-m 23100
An Apple macOS keychain database. Recover the keychain password offline.
- vBulletin < 3.8.5-m 2611
vBulletin password: md5(md5($pass).$salt). Stored as hash:salt.
- 1Password (cloud keychain)-m 23200
A 1Password cloud-keychain vault (PBKDF2-HMAC-SHA512). Recover the master password offline.
- Atlassian (PBKDF2-HMAC-SHA1)-m 12001
An Atlassian (Jira/Confluence/Crowd) password hash — PBKDF2-HMAC-SHA1 with the {PKCS5S2} prefix.
- iTunes backup >= 10.0-m 14800
An encrypted iOS/iTunes backup from iTunes >= 10 (PBKDF2-HMAC-SHA256, very high iterations).
- LDAP {SSHA256}-m 1411
Base64-encoded salted SHA-256 used by LDAP directories.
- LDAP {SSHA512}-m 1711
Base64-encoded salted SHA-512 used by LDAP directories.
- Telegram Desktop-m 22301
A Telegram Desktop local passcode (PBKDF2-HMAC-SHA1/512). Recover the passcode offline.
- Invision Power Board-m 2811
Invision Power Board password: md5(md5($salt).md5($pass)).
- iTunes backup < 10.0-m 14700
An encrypted iOS/iTunes backup created by iTunes < 10 (PBKDF2-HMAC-SHA1).
- LastPass-m 6800
A LastPass vault credential: hash:iterations:email. Recover the master password offline.
- MediaWiki $B$-m 3711
A MediaWiki (the wiki engine behind Wikipedia) password hash: md5($salt.md5($pass)) with a $B$ prefix.
- Mozilla key3.db (master password)-m 26000
A Firefox/Thunderbird master-password key database. Recover the master password offline.
- PEM / PKCS#8 private key-m 24410
An encrypted PKCS#8 / PEM private key. Recover the key passphrase offline.
- EPiServer 6.x < v4-m 141
An EPiServer (.NET CMS) password hash, version 0 (salted SHA-1).
- EPiServer 6.x >= v4-m 1441
An EPiServer (.NET CMS) password hash, version 1 (salted SHA-256).
- Java KeyStore (JKS) private key-m 15500
A Java KeyStore (.jks) private-key entry. Recover the keystore password offline.
- osCommerce / xt:Commerce-m 21
osCommerce password: md5($salt.$pass) with a 2-char salt.
- Password Safe v3-m 5200
A Password Safe v3 database (SHA-256, configurable iterations). Recover the master password offline.
- Redmine-m 7600
A Redmine project-management password: sha1($salt.sha1($pass)), stored as hash:salt.
- SAP CODVN B (BCODE)-m 7700
SAP CODVN B (BCODE) password hash.
- SAP CODVN F/G (PASSCODE)-m 7800
SAP CODVN F/G (PASSCODE) password hash based on SHA-1.
- WoltLab Burning Board 3.x-m 8400
A WoltLab Burning Board 3.x forum password: double-salted SHA-1, stored as hash:salt.
- IBM Lotus Notes / Domino 6-m 8700
An IBM Lotus Notes/Domino 6 account hash (base64 in parentheses). Crack offline for the user password.
- IBM RACF (mainframe)-m 8500
An IBM RACF (z/OS mainframe) password hash (DES). Crack offline for the mainframe password.
Tokens
Document encryption
- MS Office 2013+ (AES)-m 9600
MS Office 2013/2016/2019 document encryption (SHA-512 + AES, 100k iterations). Slow to crack.
- PDF 1.7 Level 8 (Acrobat 10-11)-m 10700
Encryption hash from a modern AES-256 PDF (Acrobat X/XI). Slow to crack.
- MS Office 2010 (AES)-m 9500
MS Office 2010 document encryption (SHA-1 + AES, 100k iterations).
- MS Office 2007 (AES)-m 9400
MS Office 2007 document encryption (SHA-1 + AES, 50k iterations).
- PDF 1.1–1.3 (Acrobat 2-4)-m 10400
Encryption hash extracted from an Acrobat 2–4 PDF. Recover the password offline.
- OpenDocument (ODF)-m 18400
An encrypted OpenDocument (LibreOffice/OpenOffice) file. Recover the document password offline.
- Apple iWork-m 23300
An encrypted Apple iWork (Pages/Numbers/Keynote) document. Recover the password offline.
Archive encryption
- WinZip (AES) / PKZIP-m 13600
An encrypted ZIP archive hash (WinZip AES or legacy PKZIP). Crack the archive password offline.
- 7-Zip-m 11600
A 7-Zip archive hash (AES-256 with many SHA-256 iterations). Slow to crack.
- RAR5-m 13000
A RAR5 archive password hash (PBKDF2-HMAC-SHA256). Slow to crack.
- RAR3-hp-m 12500
A RAR3 archive password hash. Slow iterated SHA-1 + AES.
- Android Backup-m 18900
An encrypted Android backup (adb backup) archive. Recover the backup password offline.
- AxCrypt-m 13200
An AxCrypt-encrypted file (AES + iterated key wrap). Recover the file password offline.
- StuffIt5 archive-m 12200
A password-protected StuffIt5 (.sit) archive. Recover the archive password offline.
Disk encryption
- BitLocker-m 22100
A Windows BitLocker volume hash. Memory-hard and extremely slow to attack.
- LUKS (disk encryption)-m 14600
A Linux LUKS full-disk-encryption header. Very slow PBKDF2; only weak passphrases are realistic.
- Android FDE (full-disk encryption)-m 8800
An Android full-disk-encryption footer (Android 4.3+). Recover the device password/PIN offline.
Cryptocurrency wallets
- MetaMask wallet-m 26600
A MetaMask browser-wallet vault (PBKDF2-HMAC-SHA256 + AES-GCM). Recover the wallet password offline.
- Bitcoin / Litecoin wallet.dat-m 11300
A Bitcoin/Litecoin Core wallet.dat hash. Recover the wallet passphrase offline.
- Electrum wallet-m 16600
An Electrum Bitcoin wallet hash. Recover the wallet password offline.
- Blockchain.info wallet-m 12700
A Blockchain.info My-Wallet backup. Recover the wallet password offline.
- Ethereum Wallet (PBKDF2)-m 15600
An Ethereum keystore (PBKDF2 variant) wallet hash.
- Ethereum Wallet (SCRYPT)-m 15700
An Ethereum keystore (scrypt variant) wallet hash — memory-hard and very slow.
- Ethereum Presale Wallet-m 16300
An Ethereum presale wallet hash. Recover the wallet passphrase offline.
Checksums
- CRC-32-m 11500
A 32-bit CRC checksum, not a cryptographic hash. Used for integrity, trivially collidable.
- Adler-32
A 32-bit Adler checksum used by zlib. Not cryptographic.
- CRC-32C (Castagnoli)-m 27900
A 32-bit CRC-32C (Castagnoli) checksum. Not cryptographic.
- CRC-64 (Jones)-m 28000
A 64-bit CRC checksum, 16 hex characters. Not cryptographic.