Bcrypt is a password hashing method used by many websites and apps. When you check a bcrypt hash, you are testing whether a password matches a stored hash. This guide explains how that check works, what it cannot do, and how to do it safely.
Checking is not decrypting
This is the most important idea in the whole guide. A bcrypt hash cannot be reversed back into the original password. There is no decrypt button. Checking works the other way round: you take the password you want to test, hash it with the same settings stored inside the hash, and compare the two hashes. If they match, the password is correct.
That is also why a hash is safe to store. Even if someone steals the hash, they cannot simply read the password out of it. They would have to guess passwords one by one.
What is inside a bcrypt hash
A bcrypt hash looks like a long string starting with $2b$ or $2a$, followed by a cost number and then the salt and hash. The cost number controls how much work each check takes. A cost of 10 means about a thousand rounds of work; a cost of 12 means about four thousand. Higher cost is slower for attackers, but also slower for your own server, so most apps pick 10 to 12.
Step-by-step: check a password against a hash
- Copy the full hash string, including the $2b$ prefix and the cost number.
- Enter the password you want to test. Use the exact password, including capitals and spaces.
- Run the check. The tool hashes your password with the salt from the stored hash and compares the results.
- Read the result: match means the password is correct, no match means it is not.
- If you are testing your own account, change the password afterward if you typed it into any website you do not fully trust.
Safety rules
Never paste a production password or a real user’s hash into a random website. Use test values, or run the check on your own machine. A hash alone does not reveal the password, but a password typed into an untrusted page can be logged. Also remember that bcrypt ignores everything after 72 bytes, so very long passwords are effectively cut off.
Try it the faster way
The tool below generates bcrypt hashes and checks passwords against them.
Prefer the full page? Open the bcrypt hash generator and checker directly.
Quick tips
- A “no match” result can mean a typo, an extra space, or a different password, not a broken hash.
- Use a cost of 12 for new hashes unless your server is very slow.
- Never store plain passwords; store only the hash.
Checking a bcrypt hash is simple once you accept that it only answers one question: does this password match this hash? It never reveals the password itself, and that is exactly the point.
Frequently asked questions
Can I recover a password from its bcrypt hash? No. Bcrypt is a one-way function, so the hash cannot be reversed. The only way to find the password is to guess candidates and check each one, which is slow by design. That slowness is a security feature, not a flaw.
What cost value should new projects use? A cost of 12 is a solid default on modern hardware: each check takes a fraction of a second, which users never notice but attackers feel. Raise the cost as hardware gets faster, and re-hash passwords when users next log in.
Why does checking the same password take slightly different times? Because the work factor involves thousands of internal rounds, and system load varies. Small timing differences are normal. What matters is the match result, not the milliseconds.