Question 1

How does bcrypt verification work?

Accepted Answer

Bcrypt verification hashes the plain text with the same salt embedded in the hash string, then compares the results. It does not decrypt the hash.

Question 2

What format should the bcrypt hash be in?

Accepted Answer

A valid bcrypt hash starts with $2a$, $2b$, or $2y$ followed by the cost factor and the 53-character hash string.

Question 3

Is my password sent to a server?

Accepted Answer

No. All verification happens locally in your browser. Your password and hash never leave your device.

Question 4

Can I use this to crack a bcrypt hash?

Accepted Answer

No. This tool only verifies if a known plain text matches a hash. Bcrypt is designed to be computationally expensive to brute-force.

Question 5

Why is bcrypt verification slow?

Accepted Answer

Bcrypt is intentionally slow — that is its security feature. The cost factor determines how many rounds of hashing are performed.

Bcrypt Verifier

Frequently Asked Questions