← Hashito System Home 日本語 Tools Blog Posters

Find the Source of a Hash

Match candidates and recover values from a small, constrained search space. Search conditions, examples and sample attempts are shown on screen.

Local processing only

1. Candidate matching

If you already have candidate values, this is the fast and safe option. Enter one candidate per line.

You can load candidates from a text file.

Match results

Processing is split into small batches so the screen stays responsive even with many candidates.

0Checked
0Candidates
0per sec
IdleEnter the target hash and candidates.
Hashes are one-way. This tool does not reverse them; it hashes your candidates with the same algorithm and compares for a match.
Supports SHA-1 / SHA-256 / SHA-384 / SHA-512 / CRC32 / FNV-1a 32. The SHA family uses the browser Web Crypto API; CRC32/FNV-1a use a local implementation. No external communication.
How to use: a hash is one-way, so the original input cannot be computed back from the value. This tool hashes your candidates with the same algorithm and looks for a match. If you can guess the original value, candidate matching (one per line, file upload supported) is fast and reliable. If you know rules for the character set, length or fixed text, constrained search narrows the candidates (variable part up to 8 characters, up to 1,000,000 attempts per run, "until stopped" auto-stops at 60 seconds). It is meant for verifying or recovering your own dev data, short IDs and checksums. The hash, candidates and files you enter are not transmitted.
To compute a hash from text, use the Hash Generator (SHA-1/256/384/512); to create a strong password, use the Password Generator. We also offer free learning posters that illustrate how data and the web work.
Related tools: Hash Generator (SHA) Password Generator JWT Decoder Basic Auth Header Generator

Frequently asked questions

Can I turn a hash back into the original string?

No. A hash is one-way, and the original input cannot be computed back from the value. This tool does not reverse anything: it hashes the candidate values you provide with the same algorithm and checks whether any of them match the target hash. A value that is not in your candidates will not be found. It is meant for verifying or recovering your own development data, short IDs, and checksums.

Which algorithms are supported?

SHA-1, SHA-256, SHA-384, SHA-512, CRC32, and FNV-1a 32. The SHA family is computed with the browser Web Crypto API, while CRC32 and FNV-1a use a local implementation inside the tool. The SHA family accepts hex and Base64 input; CRC32 and FNV-1a accept hex only.

What are the limits of the constrained search?

The variable part is at most 8 characters, and a single search runs up to 1,000,000 attempts. The "until stopped" mode also stops automatically at 60 seconds or 1,000,000 attempts, whichever comes first. It does not use parallel computation to go faster; it only splits the work into small chunks so the screen stays responsive. This is not built for brute-forcing long passwords, but for recovering short IDs and checksums.

Are the hash and candidates I enter sent to a server?

No. Matching, searching, and hashing all run in JavaScript inside your browser. No network API is used, and the hash values, candidates, or file contents you enter are never sent to or stored on a server.