Extract hashes from a report
Paste a threat report, a SHA256SUMS file, a package lock or a malware sandbox export. Hashes are grouped under MD5, SHA-1, SHA-256 and SHA-512 headings, each one listed once in lowercase, in the order it first appears. Upper- and lowercase copies of the same hash count as one.
Grouped by length, not identified
A hash carries no label. The grouping comes from length alone: 32 hex characters is the size of an MD5 digest, 40 of SHA-1, 64 of SHA-256, 128 of SHA-512. The same 32 characters could be an NTLM hash or a UUID written without dashes, and 64 could be SHA3-256 or an Ethereum transaction hash. Treat the headings as the likely algorithm and confirm against the source.
What is skipped
A hex run must stand alone. It cannot be one character too long or too short, and it cannot be glued to other letters, which rules out the hex-looking stretches inside Base64 data. Dashed UUIDs, all-digit strings and bcrypt or Argon2 strings (which carry their own $2b$ or $argon2id$ prefix and are not hex) are not listed.