Bcrypt Verifier
Check whether a password matches a bcrypt hash. Paste the password and a $2a$, $2b$ or $2y$ hash, and the tool reads the salt and cost from the string, recomputes the hash and answers match or no match. It helps developers debug login problems, confirm database migrations and test hashes from PHP, Node.js or Python. Hashes with a cost above 12 are refused and the password is never echoed.
Frequently asked questions
How does bcrypt verification work?
The tool reads the version, cost and salt from the hash string, hashes your password with exactly those settings and compares the result with the stored hash. If they are identical, the answer is match, otherwise no match.
Which hash formats are supported?
The tool accepts the modular crypt format with the prefixes $2a$, $2b$ and $2y$, a two-digit cost and 53 characters of salt and hash. These cover PHP password_hash, Node.js bcrypt and bcryptjs, Python bcrypt and Spring Security.
Why is my hash rejected?
The hash must be exactly 60 characters in the format $2b$10$ followed by 53 characters from bcrypt's alphabet. Check that it was not cut off by a database column or wrapped in quotes. Hashes with a cost above 12 are refused to keep the service fast.
Can I try a known example?
The published jBCrypt test vector $2a$06$If6bvum7DFjUnE9p2uDeDu0YHzrHM6tf.iqN8.yx.jNN1ILEf7h0i belongs to the password abc. Entering both returns match, and any other password returns no match.
Why is the cost limit 12?
Verifying a hash costs as much as creating it, and each cost step doubles the time. Costs above 12 can take seconds, so the tool refuses them rather than tying up the server.
Does the verifier show or store my password?
No. The response contains only the hash and the answer, never the password. Nothing is logged or saved.
Is there a maximum password length?
Bcrypt only reads the first 72 bytes of a password, and this tool rejects longer passwords rather than truncating them. If your system truncated a longer password when it created the hash, enter only its first 72 bytes.
What is the difference between $2a$, $2b$ and $2y$?
They mark fixes for old implementation bugs: $2y$ comes from PHP's crypt_blowfish fix and $2b$ from OpenBSD's fix for long passwords. For valid passwords up to 72 bytes they compute the same hash, so the tool verifies all three.
Can I verify hashes from other algorithms here?
No. This tool only checks bcrypt hashes. Use the Argon2 Verifier for strings that begin with $argon2.
Why does a new bcrypt hash of my password not equal the stored one?
Every bcrypt hash uses a new random salt, so two hashes of the same password are always different strings. That is why verification recomputes with the stored salt instead of comparing two hashes.