Validate password hash formats

Identify the password-hash format encoded in a stored string.

freeworks offlinenothing uploaded
ToolPassword Hash Format Check
Input
Output
—
Put this on your own site

The frame below runs the same code as this page, in the reader's own browser. Nothing is sent to us, and nothing is sent to you.

Pick a dark background and the text and panels follow it, so the frame stays readable on a dark page.

Preview

How it works

The encoded string is matched against known prefixes, separators, cost fields, salt sections, and digest lengths for formats such as Argon2, bcrypt, scrypt, and PBKDF2. Recognition identifies a format family; it does not recover the password or verify a hash against one.

  • Self-describing prefixes and cost fields help select a verifier.

Worked example

Check bcrypt Hash
Validate that a hash string is in a recognized password hash format
Input
											$2b$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy
Output
												=== Password Hash Format Check ===
Input: $2b$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy
Length: 60 characters

Result: VALID FORMAT (1 match)

Format: bcrypt
Description: Bcrypt password hash (Blowfish-based)
Example: $2b$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy

When to use this

Hash migrations, authentication services, and storage audits identify password encodings.

Edge cases

  • A 60-character string is not automatically bcrypt without its prefix and layout.
  • A valid-looking hash can contain an unsafe cost value.
  • Changing one salt character changes the stored encoding without changing the algorithm family.

References