bcrypt Hash Verifier
Compared in your browser. Nothing you enter is sent to a server.
What is bcrypt Hash Verifier
This tool checks whether a password matches a given bcrypt hash. bcrypt cannot be decrypted, so verifying does not reveal the original password. Instead it takes the salt and cost stored inside the hash, re-hashes the password you enter the same way, and compares the two. If they match, the password is correct. Everything runs in your browser, so neither the password nor the hash is ever uploaded.
How to use
- Paste the bcrypt hash you want to test against.
- Type or paste the password you want to check.
- Read the result. It updates as you type, showing match or no match.
- Need to create a hash instead? Use the bcrypt generator.
When to use it
Debugging a login that rejects the right password, or confirming a hash in your database was built from the password you expect? Paste the hash, type the candidate password, and see instantly whether they match. It pairs with the bcrypt generator, so you can hash a password in one tool and confirm it in the other. A common gotcha it helps catch is a truncated or altered hash string copied from a log or database.
Frequently asked questions
How can it verify without decrypting the hash?
bcrypt stores the salt and cost inside the hash itself. To verify, the tool re-runs bcrypt on the password you enter using that same salt and cost, then compares the result to the stored hash. A match means the password is right. The original password is never recovered.
Why does it say the hash is invalid?
The input must be a complete bcrypt hash: a 60-character string that starts with $2a$, $2b$ or $2y$ followed by the cost and salt. If it is truncated, missing the prefix, or has stray characters, it cannot be used, so check that you copied the whole thing.
Does it work with hashes from PHP, Node or Python?
Yes. bcrypt is a standard, so hashes made by PHP password_hash, Node's bcrypt, Python's bcrypt and others verify here regardless of the $2a, $2b or $2y prefix, as long as the password matches.
Is anything I enter uploaded?
No. The comparison happens entirely in your browser with a self-contained implementation. Your password and hash are never sent to a server or stored, which is why this tool has no share link.
Related tools
bcrypt Hash Generator
Generate a bcrypt password hash online with a chosen cost factor. Salted, one-way, and computed privately in your browser. Free bcrypt tool.
AES Text Decryption
Decrypt AES-256 encrypted text with your password in your browser. Free, private, and fully offline. No data leaves your device.
AES Text Encryption
Encrypt text with a password using AES-256 in your browser. Free, private, and fully offline. Nothing is sent to a server.