bcrypt hash checker
Does this password match this hash?
Examples temporarily replace the input and settings. You can restore your previous work.
0 characters
Output
Paste or type above to see the result here.
Your files stay on your device
This tool runs entirely in your browser. What you paste is processed on your device and is never sent to a server, so it is safe to use with tokens, keys and unpublished text.
Example
Example: checking a .htpasswd line for the user anna
A .htpasswd file has the line anna:$2y$10$..aMDPuhIhC2NyXLTDrgYOzYbzSmmIfacWV9DVpnvDCuV1dl2KhPe, and you want to know whether her password is still “correct horse”. Paste the line as it is, type the password and press check.
- The user name before the colon is kept and printed beside the result, so a whole file can be pasted and every line checked.
- $2y$10$ means bcrypt at cost 10; the next 22 characters are the salt. The password is hashed again with that salt and cost, and the two hashes are compared.
- One capital letter is enough to fail: “Correct horse” does not match.
| Line pasted | Password typed | Result |
|---|---|---|
| anna:$2y$10$..aMDP… | correct horse | anna ✓ matches (bcrypt) |
| anna:$2y$10$..aMDP… | Correct horse | anna ✗ does not match (bcrypt) |
| $2y$10$abc | correct horse | ✗ not a hash this reads (bcrypt, APR1, {SHA} or a plain MD5) |
| 5f4dcc3b5aa765d61d8327deb882cf99 | correct horse | ✗ does not match (md5) |
anna ✓ matches (bcrypt). The check only answers yes or no for the password you typed; it cannot show what any other password is.
How it works
- Paste the hash, or a whole .htpasswd line with the user name on it.
- Type the password.
- Press check. bcrypt is deliberately slow, so it takes a moment.
- Several lines at once is fine — it says which of them match.
Frequently asked questions
- Can it tell me what the password is?
- No, and nothing can. A password hash is one-way by design: the only way to test one is to make the same hash from the same salt and compare, which is exactly what this does. Any site claiming to “decrypt” bcrypt is looking the hash up in a table of ones it has already cracked.
- Is my password sent anywhere?
- No. The hashing runs in your browser and nothing leaves the machine — which is the only way a page can honestly ask you for a real password.
- Which formats does it read?
- bcrypt ($2a$, $2b$, $2y$), Apache's APR1 ($apr1$), the {SHA} form htpasswd writes, and a bare MD5 hex digest. Those cover what turns up in a .htpasswd file and in old databases.
- Why is it slow?
- Because bcrypt is meant to be. The cost factor in the hash says how slow, and the check has to do the same work the original did — that is the protection, working as intended.
- Do $2a$, $2b$ and $2y$ hashes check the same way?
- Yes. They are the same bcrypt marked by different libraries: the check rebuilds the hash from the salt and cost written in it, so a $2y$ hash from PHP and a $2b$ one from another language are read alike. The cost, the 10 in $2y$10$, only sets how long it takes.
- What about passwords longer than 72 characters?
- bcrypt uses only the first 72 bytes of a password, and so does this check: 72 characters followed by anything at all match the same hash. Accented letters and emoji take 2 to 4 bytes each, so they reach the limit sooner.
- Is it free?
- Yes.
Related tools
♭ htpasswd generator The line Apache wants, hashed on your own machine. 🔒 Password strength checker How long it would actually hold up. # Hash Generator Get the MD5, SHA-1 or SHA-2 digest of any text, computed on your device. ♭ Password generator Made on your device, by the browser's cryptographic generator. Nothing is sent anywhere.