Security Tools

Password Hash Checker

Verify whether a text value matches a given hash.

Free to use
No sign-up

Working on it…

Running the tool — your results will appear here in a moment.

No results yet

Enter the details above and run the tool to see your results here.

About this tool

Confirm whether a piece of text matches a stored fingerprint created with MD5, SHA-1, SHA-256, SHA-512 or bcrypt. It is a handy helper for developers testing login code, migrating user tables or learning how password storage works.

How to use it

Type the plain text you want to test.
Paste the stored value you want to compare it with.
Pick the algorithm that created that value.
Run the check to see a clear match or no-match result.

How the comparison works

The tool runs your text through the selected algorithm and compares the output with the value you supplied, using a timing-safe comparison. For bcrypt, which adds a random salt each time, it uses PHP's built-in password_verify() so the salt stored inside the value is respected.

Verification is not decryption

These functions are one-way. The checker cannot reveal unknown text from a stored value; it can only tell you whether text you already know produces the same result. This makes it safe for testing, but it is not a recovery tool.

Common reasons for a mismatch

The wrong algorithm was selected.
The original value was created with a salt, pepper or extra rounds that are not included here.
Extra spaces, line breaks or a different letter case in the text.
Different character encoding between systems.

Stay safe

Use test values rather than real account passwords. For storing passwords in your own applications, prefer bcrypt or Argon2 over fast algorithms such as MD5 and SHA-1.

A worked example

A developer migrating an old forum finds stored values that are 32 characters of hexadecimal — a typical sign of MD5. Testing a known test account's password against one of them confirms a match, so the team knows exactly which algorithm the old system used and can plan a safe migration to bcrypt.

Recognising common formats

MD5 – 32 hexadecimal characters.
SHA-1 – 40 hexadecimal characters.
SHA-256 – 64 hexadecimal characters.
SHA-512 – 128 hexadecimal characters.
bcrypt – about 60 characters starting with $2y$ , $2a$ or $2b$ .

Migrating away from weak storage

Keep the old values but add a new column for bcrypt or Argon2.
When a user logs in successfully, re-store their secret with the stronger algorithm.
After a transition period, force a reset for accounts that never logged in.
Remove the old values once every account has been upgraded.

Testing tips

Trim stray spaces and line breaks when copying values, and remember that letter case matters for the plain text. If a value includes a salt stored separately, this checker cannot reproduce it — check the application's code for the exact recipe.

Related tools

Password Hash Generator – create values for testing
Password Strength Checker – see how resistant a secret is
Password Generator – create random secrets

Glossary

Hash – a fixed-length fingerprint of input text.
Collision – two inputs producing the same fingerprint, a known weakness of MD5.
Cost factor – how much work bcrypt does; higher is slower and stronger.

Frequently asked questions

MD5, SHA-1, SHA-256, SHA-512 and bcrypt.

No. It only confirms whether text you already know matches a stored value; it does not reverse one-way functions.

Usually the wrong algorithm was chosen, the original used a salt or extra settings, or the text contains extra spaces.

Length and prefix are good clues: 32 hex characters suggests MD5, 64 suggests SHA-256 and $2y$ marks bcrypt.

Use test accounts instead, so real credentials never leave your systems.

The setting that controls how much work bcrypt does; higher values are slower and stronger.