bcrypt Hash Verifier

🔐 bcrypt Hash Verifier – Secure Password Hashing in Your Browser

The bcrypt Hash Verifier is a fully client-side tool for working with bcrypt password hashes. Whether you need to verify a password against a stored hash, generate a new hash for testing, inspect the internal structure of a bcrypt string, or benchmark cost factors on your device — everything runs in your browser using the bcryptjs library. No passwords or hashes are ever sent to a server.

What Is bcrypt?

bcrypt is an adaptive password-hashing function designed by Niels Provos and David Mazières in 1999, based on the Blowfish block cipher. Unlike general-purpose hash functions such as MD5 or SHA-256, bcrypt is intentionally slow — its configurable cost factor controls how many iterations are performed (2^cost), allowing you to scale computational cost as hardware improves. This makes bcrypt highly resistant to brute-force and dictionary attacks.

Understanding the bcrypt Hash Format

A bcrypt hash is a 60-character string with a well-defined structure. Here is an example:

Five Modes Explained

1. Verify

Paste a plain-text password and a stored bcrypt hash, then click Verify Password. The tool runs bcrypt.compare() in the browser, returning a clear ✅ Match or ❌ No Match result along with the wall-clock time taken — useful for calibrating expected authentication latency.

2. Generate

Enter a password, choose a cost factor (4–31, default 12) and an algorithm variant ($2b$ recommended). Click Generate Hash to produce a new, randomly-salted bcrypt hash ready for copying into your application or database seed script.

3. Inspect

Paste any bcrypt hash to get a colour-coded structural breakdown showing its version, cost factor, computed iteration count, embedded salt, and hash digest — great for debugging or learning how bcrypt strings are composed.

4. Benchmark

Run a timing test across cost factors 8–14 on your own device. A bar chart shows how long each cost takes, helping you pick a value where hashing takes ≥1 second — the OWASP-recommended minimum for production password storage. Remember that your server hardware may be faster than your browser.

5. Bulk Verify

Provide a newline-separated list of up to 50 passwords and a single stored hash. The tool verifies each password in sequence, producing a match/no-match table — useful for regression testing authentication seed scripts or confirming which test account passwords are valid.

Security Notes and Best Practices

• Use cost 12 or higher — OWASP recommends a minimum work factor of 12 (adjusted annually as hardware improves).
• bcrypt truncates at 72 bytes — any input beyond 72 UTF-8 bytes is silently ignored. This tool warns you when your password exceeds this limit.
• Prefer $2b$ — the $2a$ variant has a known bug with non-ASCII characters. New implementations should always use $2b$.
• Never use MD5 or SHA for passwords — these are general-purpose hash functions designed to be fast, making them trivially brute-forceable. Use bcrypt, Argon2, or scrypt for password storage.
• Use test credentials only — while this tool is fully client-side, treat any online tool with caution and avoid entering real production passwords.

When to Use bcrypt vs. Other Password Hashing Algorithms

bcrypt remains a solid choice for password hashing in most applications. For extremely high-security environments or when you need memory-hardness (resistance to GPU/ASIC attacks), consider Argon2id (the 2015 Password Hashing Competition winner) or scrypt. Both provide tunable memory cost in addition to time cost. However, bcrypt has outstanding library support across all major languages and frameworks, making it the most practical default for the vast majority of web applications.