SECURITY WORKSPACE
Bcrypt Hash & Verify
Hash a password or verify a supported bcrypt hash.
Input is processed on this site only when you run the tool. The application does not save inputs or results.
input.txt
changed.txt
Result result.txt
A little clarity goes here.
Run the tool to see your result.
Result preview
UTF-8 text, at most 72 bytes per input. Tab leaves the editor. Plain text disables syntax colors. Browser textareas may normalize line endings to LF.
{"hash":{"inputMode":"text","options":{"cost":{"type":"enum","values":[10,11,12],"default":10}},"inputLabels":{"input":"Password"},"inputLimits":{"input":72}},"verify":{"inputMode":"pair","options":[],"inputLabels":{"input":"Password","input2":"Bcrypt hash"},"inputLimits":{"input":72,"input2":60},"outputFormat":"json"}}{"hash":{"input":"fictional-demo-password","options":{"cost":10}},"verify":{"input":"fictional-demo-password","input2":"$2y$10$SHZ8Wfl37PyYQDSrBWk2UurlBT4R4xwiwoZS4PlSafdbq.OH2L6A.","options":[],"output":"{\"verified\":true}"}}A QUICK WALKTHROUGH
A familiar workflow,
with room to focus.
Enter a fictional or deliberately chosen password of 1–72 UTF-8 bytes.
Choose Hash with cost 10, 11 or 12, or Verify and paste a supported hash.
Run explicitly. Hashing is randomized; a failed request is never retried automatically.
When to use Bcrypt Hash & Verify
Create a supported bcrypt password hash or check a fictional password against a canonical supported hash during development.
Read the result
Hash output is randomized. Verify returns a boolean match for the allowed hash form and costs; a match is not account authentication, and unsupported hashes are rejected separately.
SEE IT IN PRACTICE
Worked examples
Sample input. A result you can inspect.
Hash example
Password
fictional-demo-password
- Bcrypt cost
- 10
Expected result
Randomized output varies on every run. The options above describe this example; no sample secret is stored.
Verify example
Password
fictional-demo-password
Bcrypt hash
$2y$10$SHZ8Wfl37PyYQDSrBWk2UurlBT4R4xwiwoZS4PlSafdbq.OH2L6A.
Expected result
{"verified":true}{"kind":"validation","title":"Password matches","tone":"success","note":"The password matches the supplied bcrypt hash.","copy":"Password matches\nThe password matches the supplied bcrypt hash.","schema":1}Formats, limits and common errors
Use the complete 60-character bcrypt hash. A verified match does not authenticate an account.
- Password and hash are sent to the server. The application does not store them; infrastructure visibility still matters.
- NUL, empty passwords and over-72-byte passwords are rejected rather than silently truncated.
- Verification accepts canonical $2y$ hashes at costs 10–12 only. Other prefixes/costs are unsupported, not reported as a wrong password. Native password functions handle hashing and comparison.
- Input: 72 UTF-8 bytes per text field. Output: at most 524,288 UTF-8 bytes; serialized responses have a separate 1 MiB ceiling. Size/work failures return no partial result.