Password hashing: bcrypt, Argon2id, scrypt, PBKDF2

Hash a password into the string a database stores, or paste a stored hash to read its algorithm, cost and salt and check a password against it. bcrypt's 72-byte limit and parameters under OWASP's minimums are called out, not glossed over.

JavaScript is off, so the in-browser engine can't run. Submitting a form sends it to this server instead, where it is processed in memory and neither logged nor stored.

Using this from the terminal

Every tool here also answers a plain POST with JSON. From a terminal your input goes to this server, unlike on the page, which runs everything in your browser.

curl https://cipher.corpberry.com/password/hash -d algo=argon2id --data-urlencode 'password=correct horse'
  curl https://cipher.corpberry.com/password/verify --data-urlencode 'password=correct horse' --data-urlencode 'hash=$argon2id$v=19$m=19456,t=2,p=1$…'

POST only. algo is bcrypt, argon2id, scrypt, pbkdf2-sha256 or pbkdf2-sha512; parameters are bcrypt_cost, argon2_m, argon2_t, argon2_p, scrypt_n, scrypt_r, scrypt_p and pbkdf2_iterations, with the limits above. These two routes have a stricter rate limit than the rest. The API runs on this server, so the password travels; this page doesn't send it anywhere.

From an AI agent (MCP): https://mcp.corpberry.com/mcp/cipher · setup

Hash a password

Password Algorithm

Show the password

bcrypt cost (4 to 14)

Argon2 memory, KiB (8 to 65536) Argon2 passes, t (1 to 10) Argon2 lanes, p (1 to 4)

scrypt cost, N scrypt block size, r (1 to 16) scrypt parallelism, p (1 to 4)

Memory is 128 × N × r bytes, 32 MiB at the default, and at most 128 MiB here. N=2^15 with p=3 is one of OWASP's equivalent minimums.

PBKDF2 iterations (1,000 to 2,000,000)

Password is

The defaults are OWASP's minimums. A random 16-byte salt is made each time, so hashing the same password twice gives two different strings; to check a password, verify it against the stored string below.

Read or check a stored hash

Paste a hash to see its algorithm, parameters and salt. Add the password to check it; the comparison runs in constant time.