Is my password sent to your server?

No. The entire verification runs in your browser using the bcryptjs JavaScript library. No data is transmitted over the network.

Which bcrypt variants are supported?

All common variants: $2a$, $2b$, and $2y$. These differ only in historical edge cases around 8-bit character handling — bcryptjs handles all of them correctly.

Why does verification take a moment for high cost factors?

Bcrypt is intentionally slow. A cost factor of 12 requires 4096 iterations; at 14 that rises to 16384. The browser runs the full computation synchronously, which may take 1–3 seconds on high cost factors.

Can I use this to crack a bcrypt hash?

No. Bcrypt is a one-way function — you must supply the exact plaintext to check. This tool only verifies a candidate you already know; it does not perform brute-force or dictionary attacks.

What is a bcrypt hash cost factor?

The cost factor (e.g. 12 in $2b$12$...) controls how computationally expensive the hash is to compute. Higher values make brute-force attacks slower. Most modern applications use 10–13.

Why does the same password produce different hashes each time?

Bcrypt embeds a random 128-bit salt in every hash, so hashing the same password twice yields different output. Verification works by extracting the salt from the stored hash and re-running the algorithm — not by comparing raw strings.

Bcrypt Hash Verifier

Enter a plaintext password and a bcrypt hash to instantly verify whether they match — all client-side, nothing sent to any server.

Verify a Bcrypt Hash

Plaintext Password

Bcrypt Hash

Starts with $2a$ , $2b$ , or $2y$

Fill in both fields and click Verify Hash

Summary

Bcrypt Hash Verifier lets you confirm whether a plaintext password corresponds to a given bcrypt hash without sending any data to a server. The tool uses the bcryptjs library compiled to WebAssembly-friendly JavaScript and runs the full bcrypt comparison directly in your browser. It supports all standard bcrypt cost factors ($2a$, $2b$, $2y$ prefixes) and displays match or mismatch in under a second.

How it works

Paste or type the plaintext password into the first field.
Paste the bcrypt hash (starting with $2a$, $2b$, or $2y$) into the second field.
Click "Verify" — bcryptjs recomputes the hash in your browser and compares it.
A clear match or mismatch result is displayed instantly.
Nothing leaves your browser — no network requests are made.

Use cases

Debug authentication issues during development by confirming the stored hash matches a known password.
Validate that a password reset flow correctly updates and stores the new bcrypt hash.
Verify bcrypt hashes generated by third-party libraries (PHP password_hash, Node bcrypt, Python bcrypt).
Audit legacy databases to confirm a known password is correctly hashed.
Teach bcrypt concepts — observe how changing the cost factor affects the hash prefix.
Double-check a backup credential before performing a production migration.

Frequently Asked Questions

Last updated: 2026-06-11 · Reviewed by Nham Vu