Bcrypt hash checker: does this password match?
A bcrypt hash cannot be reversed, but it can be verified: take a candidate password, hash it with the salt and cost stored in the hash, and compare. This bcrypt hash checker does exactly that, like PHP’s password_verify() or bcrypt.compare() in Node.js, and tells you whether the password matches.
Example
The sample hash below was created from the password password:
$2y$10$oNf6iuS8XYJmJbpK1pIyHO5aGwiTlpF0b9.435FCUy.tMMqzNrBQ2Checking password against it reports a match; any other password, even Password with a capital P, does not.
How verification works
- The hash is parsed: version (
$2y$), cost (10) and the 22-character salt. - Your password is hashed again with that salt and cost.
- The result is compared with the hash part of the stored string.
Because the salt and cost are stored inside the hash, no other information is needed. Hashes with the $2a$, $2b$, $2x$ and $2y$ prefixes are accepted. The input must be a complete 60-character bcrypt string; otherwise the tool explains that it is not a valid bcrypt hash.
What the parts of the hash tell you
The number after the version is the cost: the work factor is 2 to that power, so $10$ means 1,024 rounds of the expensive key setup and every step up doubles the time a check takes. PHP's password_hash() defaults to cost 10, while newer Laravel releases use 12. If hashes in one table show different costs, that is normal: frameworks rehash on the next login when the configured cost changes.
Bcrypt also has a fixed input limit. Only the first 72 bytes of the password are used, so two long passphrases that share the same first 72 bytes produce matching results. Multi-byte characters such as accented letters or emoji use two to four bytes each in UTF-8, so the limit is reached sooner than the character count suggests.
Debugging failed logins
- Trailing whitespace or newlines. A password copied with a trailing space is a different password. The tool ignores a single trailing newline, but other whitespace counts.
- Truncated hash column. If the database column is shorter than 60 characters, stored hashes are cut off and can never match.
- Pre-hashing or pepper. Some applications hash or HMAC the password with a secret “pepper” before bcrypt, as WordPress 6.8 does with HMAC-SHA384. Plain bcrypt verification will fail for those; use the matching tool, such as the WordPress checker.
- Different framework conventions. A password lowercased or normalised by the application before hashing must be entered the same way here.
Use it responsibly
Only check hashes from systems you own or administer, with passwords you are entitled to know — for example, confirming that a seeded test user has the expected password or that a migration preserved hashes. Bcrypt’s slowness is intentional: every check takes noticeable time at higher costs, which is exactly what protects real users’ passwords if a database leaks.
Everything runs locally in your browser; the password and hash are not uploaded. To create a new hash, use the Bcrypt Hash Generator, or for WordPress hashes the WordPress Password Hash Checker.