bcrypt verify
Check a password against a bcrypt hash, on your device.
Runs on your device. The file is never uploaded.
bcrypt verify checks one typed password against one bcrypt encoded hash and answers valid or invalid. The cost factor and the salt are read out of the string you paste, so neither is asked for. Both values reach hash-wasm unchanged, and a failure never says whether the password or the pasted string was the thing at fault.
Questions
What does it check?
A password against a bcrypt hash, using bcryptVerify from hash-wasm, answering "valid" or "invalid". Paste the whole encoded hash, the $2a$10$ or $2b$10$ form. The cost factor and the salt live inside that string, so you do not supply them separately, and a hash made at any cost factor verifies.
Which bcrypt prefixes work?
The option hint shows $2a$10$ as the example and the string is handed to hash-wasm unchanged. Prefixes vary between implementations, $2a$, $2b$ and $2y$ among them, which is one reason the source notes bcrypt has no single published test vector to check against. If a hash from another system does not verify, check the prefix before assuming the password is wrong.
Why invalid when I typed the right password?
The two common reasons are an inexact password, such as a trailing space or a curly apostrophe pasted from a document, and a damaged hash string, most often a line break added when it was copied out of an email or a log file. The tool reports only what hash-wasm returns and does no partial matching of any kind.
Can it find the password for me?
No. It tests one password at a time against one hash. There is no cracking mode, no wordlist and no dictionary attack anywhere on this site. bcrypt is deliberately slow so that guessing at scale is expensive, and nothing on this page shortcuts that.
Where does the check happen?
In this browser tab. hash-wasm runs as WebAssembly in a Web Worker on your machine, and both the password and the hash stay there. Nothing is uploaded, nothing is logged, and the tool works with the network off. That is why you can check against a hash you would not paste into a service that processes it on a server.