bcrypt password verifier

Verify a plain text password against a bcrypt hash locally in your browser. Useful for debugging authentication flows and checking password migrations

Password and hash

Supports standard $2a$, $2b$, and $2y$ bcrypt strings with cost 04 through 31.

Verification result

Run verification to see whether the password matches the hash.

Ready to verify

Paste a bcrypt hash, enter the password you want to test, then choose Verify.

What it does

Verify whether a plain text password matches a bcrypt password hash. This is useful when you are debugging login code, checking imported user records, or confirming that a password migration kept hashes compatible.

Accepted input

Paste a standard bcrypt hash such as $2b$10$... and enter the password candidate you want to test. The verifier accepts $2a$, $2b$, and $2y$ prefixes with cost values from 04 through 31.

Reading the result

A matching result means bcrypt accepted the password for that hash, including the salt and cost embedded in the hash string. A mismatch means the password did not verify; it does not prove that the hash itself is insecure. Invalid hash errors usually mean the prefix, cost, length, or bcrypt base64 characters are malformed.

Privacy and security notes

  • Inputs are processed in browser memory and are not saved to local storage.
  • bcrypt is designed for password storage, not general-purpose file checksums.
  • Use this tool for debugging and validation, not as the only audit of a production authentication system.

How to use

Enter a password and choose a cost to generate a hash, or supply an existing hash to verify. Computation can be cancelled