Check if a password matches a bcrypt hash using PHP's constant-time password_verify function. Enter the plaintext password and the bcrypt hash separated by ||| to verify the match securely.
Be the first to know when we launch a new one, plus practical tips to get more out of them. No spam.
Almost done! Check your inbox and click the link to confirm your subscription.
How to Use This Tool
Enter the password, then |||, then the bcrypt hash
Click "Verify Hash"
See whether the password matches the hash
Result uses constant-time comparison to prevent timing attacks
What is Bcrypt Checker?
Bcrypt verification is the process of confirming that a plaintext password corresponds to a stored bcrypt hash. Because bcrypt is a one-way function, you cannot "decrypt" a bcrypt hash — you can only re-hash the candidate password with the same salt (embedded in the hash) and compare the result. The bcrypt hash string contains everything needed for verification: the algorithm version ($2b$), the work factor, the 22-character base64-encoded salt, and the 31-character hash. This self-contained format is what makes bcrypt so robust. Developers use bcrypt checkers to debug authentication code, verify that hashes were generated correctly, and test user authentication flows without needing a live database.