Password Hash Verify
Check whether a plain password matches a stored password hash using the PHP password_verify() function. Works with bcrypt and Argon2 hashes created by password_hash().
What Password Hash Verify Does
Password Hash Verify uses the built in PHP function password_verify() to check whether a plain text password matches a stored password hash. This is the exact function that a correct PHP login system should use, because it compares the password against the salt and cost factor that are already embedded inside the hash string, and it does the comparison in a way that is designed to resist timing attacks.
Password hashing is not the same thing as encryption. Encryption is reversible, which means anyone holding the key can recover the original text. A password hash is a one way transformation: there is no function that turns a bcrypt hash back into the password that produced it. That is exactly what you want for stored login credentials, because if your database is ever exposed, the attacker is left with values that are extremely expensive to attack rather than a ready made list of user passwords.
How To Use This Tool
- Paste the stored password hash from your database into the hash field. It usually looks like
$2y$12$...and is around sixty characters long. - Type the plain password you want to test.
- Press the verify button. The tool reports whether the password matches, which algorithm was detected, the cost factor that was used, and whether the hash should be upgraded.
Why bcrypt And Not MD5 Or SHA-256
MD5, SHA-1, and SHA-256 were designed to be fast. That speed is a feature for file checksums and a serious weakness for passwords, because a modern graphics card can test billions of fast hash guesses per second. bcrypt and Argon2 are deliberately slow and memory demanding, and their cost factor can be raised as hardware gets faster. A single bcrypt check that takes roughly a quarter of a second is invisible to a real user logging in, but it reduces a brute force attacker from billions of guesses per second to a handful. bcrypt also salts every hash automatically, which defeats precomputed rainbow tables and stops two users with the same password from having the same stored value.
Correct Use In A PHP Project
When a user registers, run their password through password_hash() and save the returned string in a database column of at least 255 characters. Never trim, lowercase, or otherwise modify the hash, and never apply your own extra hashing on top of it. When the user logs in, load the stored hash and call password_verify() with the submitted password. Do not compare hashes with == or with a fresh call to password_hash(), because a new salt is generated each time and the two strings will never be equal. After a successful login you can call password_needs_rehash() to detect an outdated cost factor and quietly upgrade the stored hash while you still have the plain password in memory.
Privacy And Safety Notes
KST Tool Web does not store, log, cache, or share any password or hash submitted to this tool. The value is processed by PHP in a single request and then discarded, and the response headers explicitly disable caching. Even so, the safest habit is to treat any online tool as a learning and testing aid rather than a place to handle live production credentials. Use it to understand the output format, to check that your verification logic behaves as expected, or to generate a strong password for a new account. For real user accounts, run password_hash() directly inside your own application, always serve the login form over HTTPS, and add rate limiting so that repeated failed attempts are slowed down.
Frequently Asked Questions
Why is the hash different every time I press the button?
A fresh random salt is generated for every call. Different hashes for the same password is correct behaviour, and password_verify() still matches all of them.
Can I get the original password back from a hash?
No. The transformation is one way by design. Anyone offering a bcrypt decrypter is either running a dictionary attack or simply not telling the truth.
How long should my database column be?
Current bcrypt hashes are sixty characters, but the PHP manual recommends 255 characters so future algorithms and longer Argon2 output still fit without truncation.
Does password length matter with bcrypt?
Yes. bcrypt only reads the first 72 bytes of the input, so anything beyond that is ignored. This is rarely a problem for real passwords, but it matters if you pre hash long inputs before calling bcrypt.