If I have the password and hash will I be able to find out the Hashing algorithm and salt used. What tools can I can use? Will hashcat work?

  • $\begingroup$ So you're brutal-forcing the salt from a pre-selected hashing algorithms? $\endgroup$
    – DannyNiu
    Commented Dec 1, 2022 at 4:43
  • 2
    $\begingroup$ Hash strings often start with an identifier (e.g. $argon2id$). $\endgroup$ Commented Dec 1, 2022 at 8:25
  • 2
    $\begingroup$ The hash string usually also includes the salt. It's usually $<ALGORITHM_ID>$<DIFFICULTY_PARAMETERS>$<BASE64_ENCODED_SALT><BASE64_ENCODED_HASH>$. $\endgroup$ Commented Dec 1, 2022 at 13:40
  • 2
    $\begingroup$ If your hash is just the binary output of a PBKDF and the salt is both secret and large enough (i.e. it's really a "pepper") then finding out the salt and even the algorithm used may be impossible. Generally you can rely on the (meta) information in the hash string as stated above. $\endgroup$
    – Maarten Bodewes
    Commented Dec 1, 2022 at 15:01


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.