bcrypt Checker

You're staring at a bcrypt hash from a database dump, a config file, or a legacy auth table, and you need to know one thing: *does this password produce this hash?* Paste the hash, type the candidate password, hit Verify — the checker re-hashes the password with the salt and cost embedded in your hash and compares the digests. A match means the password is correct; anything else is an honest ✗.

The checker understands the whole bcrypt family: $2a$ (original OpenBSD), $2b$ (the current fixed variant) and $2y$ (PHP's spelling of $2b$) all verify. It deliberately refuses $2x$ hashes — those were produced by a buggy crypt_blowfish release and cannot be checked reliably — and it parses pasted input tolerantly, stripping the stray quotes and whitespace that shells and log files love to add. Malformed hashes get specific errors (bad prefix, wrong length, invalid characters) instead of a silent "no match", so a mangled paste never looks like a wrong password. Hashes with a cost above 14 are refused with an explanation rather than freezing your tab for minutes.

Verification runs locally in a WebAssembly worker — the password and the hash never leave your device, which is exactly how credential-checking tooling should behave.

FAQ

Can this crack or reverse a bcrypt hash?

No — and nothing can, short of guessing. bcrypt is a one-way function. This checker only answers "does *this* password match *this* hash?" by re-running the same algorithm. Recovering an unknown password means trying candidates one at a time at the hash's full cost.

Why does verification take a second or two?

That's bcrypt doing its job. The cost factor stored in the hash dictates the work, and the checker must pay that same cost to reproduce the hash. A fast verify would mean a weak hash.

The checker says my hash is malformed — but it came from my database?

Count the characters: a complete bcrypt hash is exactly 60 characters starting with $2b$ (or $2a$/$2y$). Truncated exports, missing characters from a bad copy-paste, or extra quotes from a shell are the usual suspects — the error message tells you which one it detected.