Knowing a password, corresponding hash value and the used salt I was able to reduce the possible algorithms used.

How can I obtain the hash algorithm used and its workfactor?

Note: This question is not a duplicate of "How can I find what hashing algorithm was used?" as that questions doesn't contemplate the workfactor.

1 Answer 1


The work factor only applies to some hashing algorithms, so you still need to find a reliable way of identifying the hash - and most hashes are pretty much indistinguishable in terms of output, beyond having set lengths:


are all 32 character hashes of the same input. The only way to tell which is which is to try hashing them all with functions which produce 32 character output (128-bit, in Base-64 representation).

Since the work factor needs to be known in order for the legitimate user to be able to recreate the hash, it has to be stored in some way. For example, bcrypt hashes have the cost included as the second parameter:


In these (which hash the same string as before), the cost for the first example is 4 (2^4 key expansion rounds), and for the second is 12 (2^12 key expansion rounds).

For other algorithms, it's usually part of "common representations", else it has to be stored in code, which tends to be more difficult to update should advances in hash calculation mean that increased work factors should be used. If you've only got the raw hash, without the other parts, the only way is to brute force your way through possible work factors...

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .