← All Tools

🔐 Password Hash Verifier

Identify a password hash and verify a candidate password against it — bcrypt, Argon2i, Argon2id (and read-only identification for phpass, SHA-2 crypt, and broken legacy formats). Plus a server benchmark to pick a sensible cost.

Server-side, but never logged. The hash and password are kept only in memory for the duration of the request. No database, no session storage of secrets, no analytics. Rate-limited per session.

Verify a password

Examples: $2y$12$... bcrypt, $argon2id$v=19$m=65536,t=3,p=1$... Argon2id.

Cost factor benchmark on this server

A login should take ~250–500 ms in the verifier. Use this to pick a cost factor that hits that target on your typical web hardware.

Picking a hashing scheme

  • Argon2id is the modern default. Tune memory first (target 64–256 MiB if possible), then time cost.
  • bcrypt is fine if Argon2 is not available. Cost 12 is the current floor; 13–14 if hardware allows.
  • Avoid MD5, SHA-1, unsalted SHA-256, phpass, and SHA-256/SHA-512 crypt for new systems — use them only to migrate users at next login.
  • Always pair hashing with rate limiting / account lockout (see Password Policy Tester) to stop online brute force.