How the identifier works
The cipher text identifier uses a combination of techniques to determine what algorithm likely produced a given string:
- Length fingerprinting — many algorithms produce fixed-length outputs (MD5 = 32 hex chars, SHA-256 = 64 hex chars)
- Character set analysis — hex strings only contain 0-9 a-f, Base64 uses A-Z a-z 0-9 +/=, binary uses only 0 and 1
- Shannon entropy — encrypted/compressed data has high entropy (near 8.0), natural language has low entropy (near 4.0)
- Structural pattern matching — JWTs have three dot-separated Base64URL parts, PEM certificates have specific headers, URL encoding uses % sequences
- Statistical analysis — Caesar cipher text retains natural language letter frequency distribution
Detection categories
| Category | Algorithms detected | Method |
|---|---|---|
| Hash | MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, bcrypt, NTLM | Length + hex charset |
| Encoding | Base64, Base64URL, Hex, Binary, URL encoding, HTML entities | Charset + structure |
| Modern cipher | AES-128/192/256, DES, 3DES, Blowfish (CBC/ECB output) | Length + entropy + Base64 |
| Classical cipher | Caesar, ROT13, Vigenère, Atbash, Rail Fence | Letter frequency + charset |
| Asymmetric | RSA (PEM), RSA (raw), PGP message, OpenSSH key | PEM header + structure |
| Token | JWT (HS256/RS256/ES256), API key patterns | Structure + Base64URL |
Understanding Shannon entropy
| Entropy range | Likely type | Example |
|---|---|---|
| 0.0 – 2.0 | Highly repetitive / binary flag | 0000111100001111 |
| 2.0 – 4.0 | Natural language text | Caesar cipher, Vigenere |
| 4.0 – 6.0 | Mixed / encoded text | Base64, URL encoding |
| 6.0 – 7.5 | Compressed or encrypted | AES-CBC, hashes |
| 7.5 – 8.0 | Highly random — strong encryption | AES-GCM, true random |
Limitations
Cipher identification is probabilistic, not definitive. The tool shows the most likely candidates based on observable properties. Short strings, custom encodings, or non-standard outputs may produce inaccurate results. Always verify against the context in which the cipher text was generated.