Does this password match this bcrypt hash?
Type the original password + the bcrypt hash ("$2b$12$..."), and the tool returns match or mismatch.
Everything runs locally, the password and hash never leave your browser.
Useful for devs: testing auth integrations, debugging login issues, verifying database exports. Supports "$2a$", "$2b$", "$2y$", all modern bcrypt outputs (Node bcryptjs, Python passlib, Ruby bcrypt-ruby, Java jBcrypt, PHP password_hash).
How to use it
- Type the password you want to test in the "Password" field. Eye icon for show/hide.
- Paste the bcrypt hash, must start with `$2a$`, `$2b$` or `$2y$`, exactly 60 chars.
- Click "Verify". The tool calls bcrypt.compare internally, hashes the password with the salt extracted from the hash and compares.
- Result: green "Match" with the cost factor, or red "Mismatch". Cost factor (4-15) = number of hashing rounds (more = slower, safer).
When this is useful
Five typical situations where a bcrypt verifier saves you hours of digging through logs:
- Auth debugging. A user can't log in despite "definitely" knowing the password; check if the database hash matches.
- Database migrations. After importing from another system, verify hashes carried over correctly.
- Code review / pen-testing. Check whether the app uses a sufficiently high cost factor (10+ absolute minimum in 2026, 12+ recommended).
- Recovery. An old test password you forgot but have the hash for; try variants.
- Education. See how bcrypt produces different hashes for the same password (random salt), but all match the original.
To generate a bcrypt hash, use our hash generator, has bcrypt with configurable cost factor. Generate there, verify here.
Questions and answers
No. Verification runs in the browser: bcryptjs (the same lib Node.js uses) called locally. You can verify in DevTools → Network, no upload.