About the Bcrypt Verify
Verifying a password against a bcrypt hash means running bcrypt with the salt and cost stored in the hash and checking that the result matches. This tool does that: paste the hash and type the password, and it tells you whether they correspond. It is useful when testing an authentication flow, debugging a failed login, or confirming a password before a database migration.
The check runs locally, so nothing is sent anywhere, but as with generating hashes, use test data rather than real production credentials. A match confirms the password is correct for that hash; a mismatch means it is not, or the hash is from a different password.
To create a hash in the first place, use the Bcrypt Hash Generator.
How to use
- Type the password on the left.
- Paste the bcrypt hash in the toolbar.
- Read whether they match.
Common questions
- How can it verify without the salt?
- The salt is embedded in the bcrypt hash string, so the verifier extracts it automatically.
- Is the password sent anywhere?
- No. Verification runs in your browser.
- It says no match but I am sure it is right. Why?
- Check for a trailing space or a truncated hash. The whole $2b$... string must be pasted intact.