Blowfish-based · password storage · salted
bcrypt is based on the Blowfish cipher, designed by Niels Provos and David Mazieres in 1999. Deliberately slow with a configurable cost factor. Widely used for password storage in web applications.
bcrypt hash reference box.Algorithm version line to see whether the hash is $2a$, $2b$, or $2y$.Cost factor and Total cost to see how many rounds (2^N) the hash was stretched.Salt (Base64) and Hash (Base64) lines, then delete the text to analyze another hash.Confirm a pasted string matches the exact $2a$10$… layout before trusting it in code or configuration.
See at a glance how expensive a hash is (2^N rounds) and audit whether your app's work factor is still strong enough.
Split the hash into its 22-character salt and 31-character digest to see how bcrypt stores both in one string.
Identify $2a$, $2b$, and $2y$ variants — and the PHP-specific notes that come with them.
A plain-language breakdown of the format, handy when implementing or migrating password storage.
Analysis runs entirely in your browser. The hash you paste is never sent to or stored on a server.
bcrypt is a password-hashing function based on the Blowfish cipher, designed by Niels Provos and David Mazières in 1999. It's deliberately slow and salted, making brute-force attacks far harder than with fast hashes like MD5 or SHA.
$2a$10$… format mean?The string breaks into four parts: $2a$ is the algorithm version, 10 is the cost factor, the next 22 characters are the salt, and the final 31 characters are the hash digest.
$2a$, $2b$, and $2y$?They're closely related versions. $2a$ is the original but has a bug in some PHP implementations; $2b$ is the fixed version; $2y$ is PHP's alias for $2b$. For PHP, use $2b$ or $2y$.
It's a work factor controlling how many rounds bcrypt runs. A cost of 10 means 2^10 = 1,024 iterations. Raising it slows both attackers and your server, so tune it to your hardware.
No. This is a reference tool that parses an existing hash's structure. bcrypt isn't available in browser Web Crypto, so hashing and verification happen server-side, e.g. bcrypt (Node.js), bcrypt (Python), or pwhash::bcrypt (Rust).
A valid hash must match exactly: a version prefix ($2a$, $2b$, $2x$, or $2y$), a one- or two-digit cost, a 22-character salt, and a 31-character digest — all using bcrypt's Base64 alphabet (A–Z, a–z, 0–9, ., /). A missing or extra character breaks the match.
No. Everything runs locally in JavaScript. The hash you paste is never uploaded, logged, or sent to any server.