Bcrypt Verifier

Verify bcrypt hashes locally. Paste a bcrypt hash (the <code>$2a$10$...</code> kind) and a candidate password — get a match / mismatch verdict in milliseconds. The tool also decodes the cost factor (rounds) and salt structure for inspection.

What this tool does

Verifies a candidate password against a bcrypt hash. Useful when:

• Debugging an auth issue — does the user’s password actually match the stored hash?
• Auditing a database export — confirming you have the right hash format.
• Testing a migration — verifying the hash survives a re-encoding.

How bcrypt verification works

Bcrypt encodes the salt and cost factor into the hash itself: $2b$12$saltsaltsalt22charsHashHashHashHashHashHas. Verification:

1. Parse algorithm version, cost factor, salt from the stored hash.
2. Compute bcrypt(password, salt, cost).
3. Compare the resulting hash bytes to the stored hash.
4. Constant-time comparison to prevent timing attacks.

Same password + same salt + same cost → same hash. The check takes ~100ms at cost 10, ~400ms at cost 12, ~1.6s at cost 14.

Bcrypt password hashing in Python and FastAPI

The common FastAPI pattern uses passlib (or bcrypt directly) to hash on signup and verify on login:

from passlib.context import CryptContext
pwd = CryptContext(schemes=["bcrypt"], deprecated="auto")

hashed = pwd.hash(plain_password)              # store this
ok = pwd.verify(plain_password, hashed)        # at login

Or with the bcrypt package directly:

import bcrypt
hashed = bcrypt.hashpw(pw.encode(), bcrypt.gensalt(rounds=12))
ok = bcrypt.checkpw(pw.encode(), hashed)

Wire pwd.verify into your /login route and pwd.hash into /register. When debugging why a login fails, copy the stored hash and the password into this verifier — if it matches here but fails in the app, the bug is in how you load or encode the value (a common one: passing a str where bytes is expected, or the 72-byte truncation below).

How bcrypt works and whether it is secure

Bcrypt is a deliberately slow, salted, adaptive hash built on the Blowfish cipher. “Adaptive” means the cost factor lets you make it slower as hardware speeds up. It is still considered secure for password storage in 2026 — the OWASP Password Storage Cheat Sheet lists both bcrypt and Argon2id as acceptable, recommending Argon2id for new systems and bcrypt (cost ≥ 10, ideally 12) where Argon2 is unavailable. Its main limitation is the 72-byte input cap; pre-hash longer inputs with SHA-256.

Common workflows

Debug a login failure. Copy the stored hash from your DB, paste the user’s password, see if they match. If yes, the bug is elsewhere; if no, the password is wrong.

Verify a hash generator. Generate a hash in your application code, paste it here with the original password. Mismatch means your generator is broken.

Inspect cost factors across a system. Old hashes may use cost 8 or 10; new hashes should use 12+. Decoding makes the distribution visible.

Why bcrypt vs Argon2 vs scrypt

If you are choosing today: Argon2id. If you have bcrypt: keep it, raise the cost periodically.

Last updated: 2026-07-04