← All Tools

Password Hash Verifier & Identifier

Paste a password hash to identify the algorithm and grade its parameters against OWASP guidance — entirely in your browser. Supports bcrypt, Argon2, sha-crypt, md5crypt, phpass, PBKDF2, scrypt, LDAP and raw digests. Then, for schemes PHP can compute, optionally verify a candidate password on the server.

Two layers, clearly separated. Identify & analyse runs 100% in your browser — the hash never leaves your device. Verify a password sends the hash and candidate to our server to compute the KDF (the only correct way to check bcrypt/Argon2/sha-crypt); they are kept in memory for the request only and are never logged or stored. No database, no analytics. Rate-limited per session.

1. Identify & analyse in your browser

Password hash

Paste a PHC/crypt string (e.g. $2y$12$…, $argon2id$v=19$…, $6$…) or a raw digest. Nothing is sent anywhere.

Analysis updates as you type.

Try an example:

2. Verify a password server-side

Checks a candidate password against the hash by computing the KDF. Available for bcrypt, Argon2i/Argon2id and sha-crypt ($1$/$5$/$6$). Other schemes are reported as NOT CHECKED — this tool will not fake a verdict.

3. Cost factor benchmark on this server

A login should take ~250–500 ms in the verifier. Use this to pick a cost factor that hits that target on your typical web hardware.

How to use & worked examples

Identify: paste the hash into box 1. The family, parameters and an OWASP-based grade appear instantly — nothing is sent anywhere.
Review parameters: read the “Evidence” (observed facts) and “Parameter strength” (recommendations) sections. Each finding carries a status and a reference.
Verify (optional): if the scheme is server-computable, use box 2 to check a candidate password. Otherwise you get an explicit NOT CHECKED.
Tune cost: use box 3 to pick a work factor that keeps a verify near 250–500 ms on your hardware.

Good case: $2y$12$… → bcrypt, cost 12 → PASS, server-verifiable.
Bad case: 5ebe2294ecd0e0f08eab7690d2a6ee69 → raw MD5/NTLM → FAIL (unsalted fast hash) and NOT CHECKED for verification.
Edge case: $2y$12$short → malformed bcrypt → FAIL (truncated), not a false positive.

Picking a hashing scheme

Argon2id is the modern default. Tune memory first (OWASP baselines from 7–46 MiB; RFC 9106 suggests 64 MiB, t=3 when memory-constrained), then time cost.
bcrypt is fine if Argon2 is not available. OWASP floor is cost 10; 12–14 on current hardware. Remember the 72-byte password limit.
Avoid MD5, SHA-1, unsalted SHA-256, phpass, and sha-crypt for new systems — use them only to migrate users at next login.
Always pair hashing with rate limiting / account lockout (see Password Policy Tester) to stop online brute force.

References: OWASP Password Storage Cheat Sheet · RFC 9106 (Argon2) · RFC 7914 (scrypt).