Bcrypt Verify
Free bcrypt verify tool - check a plaintext password against a bcrypt hash in your browser.
About Bcrypt Verify
This bcrypt verify tool checks whether a plaintext password matches an existing bcrypt hash. Bcrypt is a one-way password hashing function: you cannot decrypt the hash; you verify by hashing the attempt with the same salt/cost embedded in the hash string and comparing the result.
Paste the candidate password and a full bcrypt hash (typically starting with $2y$, $2a$, or $2b$), then run Verify. Use this for local development, seed data checks, and learning - not as a substitute for your app’s server-side auth in production.
When verification helps
- Confirming a known password matches a hash from a local DB seed
- Debugging login failures after a cost-factor or hasher change
- Checking a hash produced by the companion Bcrypt Hash Generator
- Teaching how password verification differs from encryption
How to use
- Enter the plaintext password you want to test.
- Paste the full bcrypt hash string into the hash field.
- Run Verify and read the match / no-match result.
- If it fails, confirm you copied the entire hash and used the same password encoding.
Security notes
- Prefer verifying real user passwords inside your application’s trusted server code.
- Never paste production admin credentials into online tools when you can avoid it.
- Do not store plaintext passwords. Store only hashes, and never log password + hash together.
- Rate-limit login endpoints; verification here does not protect a live form.
FAQ
Is bcrypt encryption? No. It is one-way hashing. Success means “this password matches,” not “here is the decrypted secret.”
Why does a correct password still fail? Truncated hashes, wrong algorithm prefix, or accidental whitespace/newlines in the paste are common causes.
Which tool creates the hash? Use the Bcrypt Hash Generator on this site, then verify here with the same password.