Bcrypt

What it's for

Make a bcrypt hash of a password, or check whether a password matches a bcrypt hash. Bcrypt is a deliberately slow password hash used by many web frameworks (PHP’s password_hash, Laravel, Ruby on Rails, Spring Security and others) to store passwords so that a stolen database is hard to crack.

For example, when you need to set a user’s password directly in a database or a config file, or want to confirm which password a test account’s hash belongs to.

How to use it

Under Hash a password, type the password, choose a cost and choose Hash. Each step up in cost doubles the work; the cost is remembered. A random salt is added each time, so the same password gives a different hash every time, and every one of them checks correctly.

Under Check a password, paste a bcrypt hash and type a password: the tool says whether they match, and shows the hash’s version, cost and salt. Hashes starting $2a$, $2b$ and $2y$ (PHP’s form) are all accepted.

Example

Paste this hash under Check a password:

$2b$10$Z5PB7ItoGAt17S/Sg.pSm.392kQ5R4znsW4kOMsc7geSwxSF7UdyS

and type correct horse as the password: it reports Match. The cost is shown as 10, and the salt as Z5PB7ItoGAt17S/Sg.pSm.. Type anything else and it reports No match.

Good to know

Bcrypt reads only the first 72 bytes of a password, so longer ones match on their start alone; the tool warns when that happens. Costs above 15 take too long in a browser to be useful here. Passwords never leave the page, but take care where you paste real hashes and passwords.