What does each part of a bcrypt hash string mean?

Take $2b$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy apart: $2b$ is the algorithm version identifier, $10$ is the cost factor (2^10 = 1024 internal rounds), the next 22 characters (N9qo8uLOickgx2ZMRZoMye) are the base-64-ish-encoded 16-byte salt, and the final 31 characters are the actual hash output. All four pieces travel together in one string, which is exactly what lets bcrypt verification work without a separate salt lookup.

What's the difference between the 2a, 2b, 2x, and 2y version identifiers?

They mark revisions to bcrypt's reference implementation, not the underlying algorithm. The original OpenBSD implementation used $2$; $2a$ added proper Unicode/UTF-8 handling but had a known bug where certain 8-bit characters could wrap the internal length counter, subtly weakening some hashes. $2x$ and $2y$ were transitional identifiers introduced by the crypt_blowfish library to explicitly flag hashes affected by (2x) or fixed for (2y) that bug during the transition. $2b$ is the current, corrected version that fixed the wraparound bug properly and is what modern bcrypt libraries produce by default.

Can this tool crack or reverse the hash it's analyzing?

No, and it doesn't try to. This tool does pure string parsing, splitting an already-computed hash string into its labeled components (version, cost, salt, hash). It never attempts to recover the original password; bcrypt is specifically designed to make that computationally expensive by construction, and parsing the string format tells you nothing about the input that produced it.

Does this tool send my hash to a server?

No. The parsing happens entirely in your browser with a regular expression and string slicing, no hashing or network request involved, so nothing you paste here is transmitted anywhere.

Bcrypt Hash Analyzer - Parse a Bcrypt Hash String

Overview

Introduction

A bcrypt hash string looks like an opaque blob, but it's actually four clearly delimited fields packed together: version, cost factor, salt, and hash.

This tool parses any bcrypt hash string you paste in and shows those four components as labeled fields, entirely in your browser, with no hashing involved at all.

What Is Bcrypt Hash Analyzer?

A bcrypt hash analyzer: pure string parsing that splits a bcrypt-formatted hash (following the general modular crypt format convention of $id$params$hash) into its version identifier, cost factor, salt, and hash fields.

It performs no cryptographic computation itself, just structural parsing of an already-computed bcrypt output string, distinct from this category's Bcrypt Hash Calculator, which actually computes new hashes.

How Bcrypt Hash Analyzer Works

The input is matched against bcrypt's fixed string structure: a version identifier (2, 2a, 2b, 2x, or 2y) between dollar signs, a two-digit cost factor, then exactly 53 more characters split into a 22-character salt and a 31-character hash.

If the input doesn't match that structure, exactly (wrong length, invalid characters, missing delimiters), the tool reports a clear parsing error rather than guessing at a partial result.

When To Use Bcrypt Hash Analyzer

Use this to understand or debug a bcrypt hash you're looking at, confirming its cost factor before deciding whether to upgrade it, or checking which version identifier a stored hash uses.

Don't expect this tool to verify a password against the hash or recover the original input, it only parses the string's structure, it doesn't hash anything or attempt any kind of reversal.

Often used alongside Bcrypt Hash Calculator and MD5 Hash Calculator.

Features

Advantages

Instant, purely local string parsing, no computation delay unlike this category's actual hashing tools.
Makes bcrypt's self-contained format (version + cost + salt + hash in one string) concrete and easy to see at a glance.
Clear, specific error messages for malformed input rather than a silent failure or crash.

Limitations

Cannot verify whether a hash actually matches a given password, that requires re-hashing with the extracted salt and cost factor and comparing, which this tool doesn't do.
Only recognizes the standard modular-crypt-format bcrypt string; hashes stored in a non-standard wrapper format (e.g. prefixed differently by a specific framework) may need to be unwrapped first.
Provides no information about the original password; that's bcrypt working as intended, not a limitation of the parser.

Examples

Parsing a well-known example bcrypt hash

Input

$2b$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy

Output

version: 2b, costFactor: 10, salt: N9qo8uLOickgx2ZMRZoMye, hash: IjZAgcfl7p92ldGxad68LJZdL17lhWy

A widely used example bcrypt hash, broken into its four components: version 2b, cost factor 10 (2^10 = 1024 rounds), a 22-character salt, and a 31-character hash.

Best Practices & Notes

Best Practices

Check the parsed cost factor when auditing stored password hashes; a low cost factor (e.g. 4-6) on a production system is worth investigating and potentially re-hashing at a higher cost.
Note the version identifier when migrating between bcrypt libraries; a $2a$ hash predating the wraparound-bug fix may warrant re-hashing rather than assuming it's equivalent to a $2b$ hash.
Remember this tool never validates a password, pair it with actual bcrypt verification logic in your application for that.

Developer Notes

Implemented as a single regular expression (/^\$(2[abxy]?)\$(\d{2})\$([./A-Za-z0-9]{53})$/) plus string slicing, no hashing library involved. The 53 trailing characters split deterministically into a 22-character salt and 31-character hash because bcrypt's Base64-like alphabet encodes the fixed 16-byte salt and 24-byte (192-bit, though only 184 bits are meaningful) hash at those exact lengths. Malformed input returns a descriptive error rather than throwing.

Bcrypt Hash Analyzer Use Cases

Auditing a stored password hash's cost factor before deciding whether to increase it
Identifying which bcrypt version (2a/2b/2x/2y) produced a given hash
Extracting a hash's salt and hash fields for debugging a custom bcrypt implementation
Teaching bcrypt's self-contained string format to someone new to password hashing

Common Mistakes

Expecting this tool to verify a password or recover the original input from the hash; it only parses structure, it performs no hashing or cracking.
Assuming all bcrypt-like strings use exactly this format; some frameworks wrap or prefix bcrypt hashes differently before storage.
Treating the version identifier as a security level indicator rather than an implementation-history marker; $2b$ is simply the current, bug-fixed version.

Tips

Use the Bcrypt Hash Calculator alongside this tool to generate a fresh hash and immediately see its own components parsed back out.
If parsing fails, double-check for accidental whitespace or truncation, bcrypt hashes are exactly 60 characters long including both dollar-sign delimiters.

Bcrypt Hash Analyzer