Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Given the input:


A system generates the following output hash:


I do not know the algorithm, or what salt (if any) is being used. However, I can feed the system any input I choose, and receive a hash in return.

Given the above, is there a way I can determine which hashing algorithm is in use? Could I also find out if a salt is being used and, if so, what it is?

share|improve this question
Where did this hash come from? It doesn't look like a pure cryptographic hash - too many 00 pairs. Without knowing more, this is impossible. Besides, we don't tend to accept questions like this on StackExchange - we have guidelines about question quality and this would fall under "too localised" and "not a real question" - see the FAQ for details. –  Polynomial Feb 5 '13 at 16:21
Have you by any chance omitted some characters from the hash (like ":") ? –  Dinu S Feb 5 '13 at 16:28
Scratch that - on second thoughts your question is quite interesting. Since you have the ability to ask the system to hash any arbitrary message, it may be possible to recover the mechanism. I don't see it being trivial though. Depends how much more information we have. –  Polynomial Feb 5 '13 at 16:29
@Nontenda, can you give more examples of input and output? –  Cristian Dobre Feb 5 '13 at 16:48
Dinu S : No, this is all the string. –  Nontenda Feb 5 '13 at 16:50

1 Answer 1

up vote 5 down vote accepted

To find out if a salt is used, try to use the hash the same value again (as if it was a "new password"). If you get a distinct output, then there is some non-determinism (aka "a salt"); otherwise, there is no salt.

If the hashing mechanism is meant to be secret, and was done properly, then it is a MAC and you will not be able to rebuild it from analysis of inputs and outputs alone. If it was not done properly, then... anything goes.

share|improve this answer
Having a deterministic algorithm does not mean that no salt is added. EG I can write a function that takes an input, adds a deterministic salt to the input value, then return an MD5 of this combination. This still is a hashing function, but a slat is added. –  almathie Feb 5 '13 at 16:49
@almathie That isn't true. When the salt is secret and static, it is no longer a salt; it is the key for a MAC. –  Polynomial Feb 5 '13 at 17:03
Indeed, "test" twice does not result in the same hash. So I suppose it will be very difficult to find the way it is encrypted ? –  Nontenda Feb 5 '13 at 20:53
@Nontenda: this will be hard, unless you resort to the usual method called "reverse engineering": grab the code for the server and see what's in it. Alternatively, offer two pints of Guinness to the developer and he will tell you everything there is to know about the system. –  Thomas Pornin Feb 5 '13 at 20:58
Alright, I'll try to contact the developer (hard) or reverse the code. It seems that the hash is not a known hash, isn't it ? Thank you anyway :) –  Nontenda Feb 5 '13 at 21:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.