Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Given the input:


A system generates the following output hash:


I do not know the algorithm, or what salt (if any) is being used. However, I can feed the system any input I choose, and receive a hash in return.

Given the above, is there a way I can determine which hashing algorithm is in use? Could I also find out if a salt is being used and, if so, what it is?

share|improve this question
Where did this hash come from? It doesn't look like a pure cryptographic hash - too many 00 pairs. Without knowing more, this is impossible. Besides, we don't tend to accept questions like this on StackExchange - we have guidelines about question quality and this would fall under "too localised" and "not a real question" - see the FAQ for details. – Polynomial Feb 5 '13 at 16:21
Have you by any chance omitted some characters from the hash (like ":") ? – Dinu S Feb 5 '13 at 16:28
Scratch that - on second thoughts your question is quite interesting. Since you have the ability to ask the system to hash any arbitrary message, it may be possible to recover the mechanism. I don't see it being trivial though. Depends how much more information we have. – Polynomial Feb 5 '13 at 16:29
@Nontenda, can you give more examples of input and output? – Cristian Dobre Feb 5 '13 at 16:48
Dinu S : No, this is all the string. – Nontenda Feb 5 '13 at 16:50
up vote 10 down vote accepted

To find out if a salt is used, try to use the hash the same value again (as if it was a "new password"). If you get a distinct output, then there is some non-determinism (aka "a salt"); otherwise, there is no salt.

If the hashing mechanism is meant to be secret, and was done properly, then it is a MAC and you will not be able to rebuild it from analysis of inputs and outputs alone. If it was not done properly, then... anything goes.

share|improve this answer
@almathie That isn't true. When the salt is secret and static, it is no longer a salt; it is the key for a MAC. – Polynomial Feb 5 '13 at 17:03
Indeed, "test" twice does not result in the same hash. So I suppose it will be very difficult to find the way it is encrypted ? – Nontenda Feb 5 '13 at 20:53
@Nontenda: this will be hard, unless you resort to the usual method called "reverse engineering": grab the code for the server and see what's in it. Alternatively, offer two pints of Guinness to the developer and he will tell you everything there is to know about the system. – Thomas Pornin Feb 5 '13 at 20:58
@Nontenda: as a wild guess, the string is some encoding which begins with the salt, and ends with the hash value, with some glue between the two (for at least the three '00' bytes in the middle). The hash value would then have length 32 bytes, which makes SHA-256 a plausible hash function. Then it depends on how the salt and input string are mixed together in the hash function input, and the number of possible combinations is high. Also, there could be several (possibly many) nested hash function invocations (as a "slowdown" feature, which is desirable when hashing passwords). – Thomas Pornin Feb 5 '13 at 21:30
Security through obscurity is an anti-requirement. Encourage the developer or company to open their methodology to analysis and comment. After the Guinness. – Andrew Philips Nov 12 '15 at 1:43

I do not think you can. Hashing destroys information. You also will not be able to determine details like the number of rounds and feedback...

share|improve this answer

The only data we have to work with is:

  • input data and length
  • output data and length

Conceptually the output data itself should provide no information since cryptographic hash algorithms are not meant to convey information in their output.

The only bit of information that's useful here is the length of the output data which is 105 hex digits indicating the output is 840 bits.

If you can determine the algorithm used you might have a small change of determining if the data was salted, otherwise there's no chance.

Here's a list of cryptographic hashing algorithms and their matching output size, none is 840 bits long.

I'll echo some of the comments, this doesn't look like the output of a cryptographic hashing algorithm, rather encoded data. The data after the 10000001 sequence is 64 bytes, that is characteristic of many hashing algorithms, namely SHA-512.

share|improve this answer
Wild guess: it may return the concatenation of the hash and the random salt. – borjab Jan 20 at 14:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.