crypto_bcrypt_verify
Check if a plaintext password matches a bcrypt hash. Parses the hash for cost, salt, and version, then returns match status and a strength analysis of the cost factor.
Instructions
Bcrypt Password Verifier. Check whether a plaintext password matches an existing bcrypt hash, using the cost and salt that bcrypt encodes inside the $2a$/$2b$/$2x$/$2y$ hash string. Use this to verify a candidate password against a stored hash; use crypto_bcrypt instead to generate a new hash. Runs locally with PHP password_verify on the input you provide: read-only, non-destructive, contacts no external service, and is rate-limited (5 requests/minute for anonymous callers). Returns whether the password matched, the cost/salt/version parsed from the hash, and a strength analysis of that cost factor.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| password | Yes | The plaintext password to test against the hash. | |
| hash | Yes | The bcrypt hash to verify against, in modular crypt format $2<version>$<cost>$<22charSalt><31charDigest> as produced by crypto_bcrypt. The cost and salt are read from this string to recompute the digest and compare it against the supplied password; no separate cost or salt parameter is needed. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| password | No | The plaintext password that was tested (echoed back from the request). | |
| hash | No | The bcrypt hash that was verified against (echoed back from the request). | |
| valid | No | True when the password matches the supplied bcrypt hash. | |
| duration | No | Time taken to run the verification, in seconds (rounded to 3 decimals). | |
| info | No | Fields parsed from the bcrypt hash; contains only error when the hash format is invalid. | |
| format | No | Structural breakdown of the hash string. | |
| security | No | Strength analysis of the parsed cost factor; null when no cost could be read from the hash. | |
| error | No | Present only on a 4xx/5xx error response (e.g. missing password or hash); absent on success. |