bcrypt hash checker

How it works

1. Paste the hash, or a whole .htpasswd line with the user name on it.
2. Type the password.
3. Press check. bcrypt is deliberately slow, so it takes a moment.
4. Several lines at once is fine — it says which of them match.

Frequently asked questions

Can it tell me what the password is?

No, and nothing can. A password hash is one-way by design: the only way to test one is to make the same hash from the same salt and compare, which is exactly what this does. Any site claiming to “decrypt” bcrypt is looking the hash up in a table of ones it has already cracked.

Is my password sent anywhere?

No. The hashing runs in your browser and nothing leaves the machine — which is the only way a page can honestly ask you for a real password.

Which formats does it read?

bcrypt ($2a$, $2b$, $2y$), Apache's APR1 ($apr1$), the {SHA} form htpasswd writes, and a bare MD5 hex digest. Those cover what turns up in a .htpasswd file and in old databases.

Why is it slow?

Because bcrypt is meant to be. The cost factor in the hash says how slow, and the check has to do the same work the original did — that is the protection, working as intended.

Is it free?

Yes.