Is it possible to find the hash algorithm used for a password given that you have the clear-text password and its hash?

The algorithm in question hashes the string 'password' to 'da0feea11db421a7be1173895497e71f', and there is no salt used.

  • $\begingroup$ Google gives you the result... $\texttt{md5(19f7c908f1a949ca0003b5c30ccc5282)} = \texttt{da0feea11db421a7be1173895497e71f}$ $\endgroup$ – Biv Jul 7 '17 at 14:04
  • $\begingroup$ @Biv: as you probably realized it, the above fact gives assurance that whatever generated da0feea11db421a7be1173895497e71f is MD5-based (the other alternative is a preimage attack on MD5). For the rest, we can't be sure. That's a hell of a strange password hash algorithm if its last step is MD5-hashing the lowercase hexadecimal for a 128-bit value, but if the input really is the string 'password' I see no other credible alternative. $\endgroup$ – fgrieu Jul 7 '17 at 16:02
  • $\begingroup$ Somewhat related: Determine hashing algorithm $\endgroup$ – e-sushi Jul 7 '17 at 20:27

Assuming they are using a publicly known algorithm, there are so few that brute-force would be pretty quick. You could also look at the length of the output and use that to help down select the number of algorithms.

If they are doing anything (even semi) tricky to hide the algorithm, however, it could be impossible.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy