Bcrypt Password Verifier
Check whether a password matches a bcrypt or Argon2 hash.
How to use the Bcrypt Password Verifier
- Enter the password you want to test.
- Paste the stored hash into the second box.
- Click Check — you will get a clear match or no-match answer.
About the Bcrypt Password Verifier
You cannot verify a salted hash by hashing the password again and comparing strings — the new hash gets a new random salt, so it will never match. Verification works the other way round: the salt and cost are read out of the stored hash, the password is re-hashed with those exact parameters, and the results are compared.
This tool does that for both bcrypt ($2y$…) and Argon2 ($argon2i$…, $argon2id$…), the same way PHP's password_verify() does. It is handy when a login is mysteriously failing and you want to know whether the password is wrong or the application logic is.
The comparison itself is timing-safe, meaning it takes the same time whether the first character matches or none do — a detail that stops attackers from learning a hash one character at a time.
Frequently asked questions
Why not just hash the password and compare?
Because bcrypt salts every hash randomly, so hashing the same password twice gives different strings. Verification has to reuse the salt stored inside the original hash.
Which hash formats work here?
bcrypt ($2y$, $2a$, $2b$) and Argon2 ($argon2i$, $argon2id$). Plain MD5 or SHA hashes are not salted password hashes and will be rejected.
It says no match but I am sure the password is right.
Check for a stray space or newline when you pasted the hash, and make sure the hash was not truncated — bcrypt hashes are always exactly 60 characters.
Are the password and hash stored?
No. Both are used for the check and discarded immediately. Nothing is logged.