← All Tools
Password Hash Verifier
Identify a password hash and verify a candidate password against it — bcrypt, Argon2i, Argon2id (and read-only identification for phpass, SHA-2 crypt, and broken legacy formats). Plus a server benchmark to pick a sensible cost.
Server-side, but never logged. The hash and password are kept only in memory for the duration of the request. No database, no session storage of secrets, no analytics. Rate-limited per session.
Verify a password
Cost factor benchmark on this server
A login should take ~250–500 ms in the verifier. Use this to pick a cost factor that hits that target on your typical web hardware.
Picking a hashing scheme
- Argon2id is the modern default. Tune memory first (target 64–256 MiB if possible), then time cost.
- bcrypt is fine if Argon2 is not available. Cost 12 is the current floor; 13–14 if hardware allows.
- Avoid MD5, SHA-1, unsalted SHA-256, phpass, and SHA-256/SHA-512 crypt for new systems — use them only to migrate users at next login.
- Always pair hashing with rate limiting / account lockout (see Password Policy Tester) to stop online brute force.