bcrypt & Argon2 Explainer - Decode Cost Factors

chain

Password Hash Explainer — what every field in a bcrypt or Argon2 string means never leaves your browser

STORED HASH

FORMATS THIS RECOGNISES

Prefix	Algorithm	Cost is expressed as

Password Hash Explainer Online

Updated 2026-10-24

Paste a bcrypt, Argon2, SHA-crypt or PBKDF2 hash and see exactly what it says. These formats store their own parameters in the string (the algorithm, the salt, and the cost settings that decide how expensive the hash is to compute), and this tool splits that apart and explains each field, then tells you whether the work factor still holds up against current OWASP guidance.

It explains; it does not crack. There is no password input and nothing is tested against the digest, because a password hash is one-way by construction. Everything runs in your browser, which matters more here than on most tools: a real production hash should never be pasted into a server you do not control. If you have a bare MD5 or SHA-256 digest with no $ prefix, that carries no parameters to read; the hash identifier is the right tool for those.

// how to use

1 Paste a stored password hash, the whole string, including the $ prefix and cost parameters.
2 SnapTools splits it into its fields and explains what each one is for.
3 Check the verdict at the top: it compares the work factor against current OWASP guidance.

// examples

bcrypt

Input

$2b$12$LQv3c1yqBWVHxkd0LHAkCOYz6TtxMQJqhN8/LewdBPj/HcNbLuLLu

Output

Variant  $2b$   the current OpenBSD version
Cost     12     2^12 = 4,096 iterations
Salt     LQv3c1yqBWVHxkd0LHAkCO   16 bytes, stored with the hash by design
Digest   Yz6TtxMQJqhN8/LewdBPj/HcNbLuLLu
→ Cost 12 meets current guidance.

Argon2id with a weak memory cost

Input

$argon2id$v=19$m=4096,t=1,p=1$c29tZXNhbHQ$RdescudvJCsgt3ub+b+dWRWJTmaaJObG

Output

Memory       m=4096   4 MiB per hash
Iterations   t=1      one pass over that memory
Parallelism  p=1      one lane
→ Current guidance is at least 19,456 KiB with t=2; this uses 4,096 KiB with t=1.

A hash from /etc/shadow

Input

$6$rounds=656000$saltstring$WvvTPHKwdBJ3uk/DdBFPl4RnKGvZBcCiKBrJmHYkJlD6Zj...

Output

Scheme   $6$              SHA-512-crypt
Rounds   656000           iterations
→ Acceptable for system accounts, but not memory-hard, so it resists GPU cracking
  far less well than bcrypt or Argon2id.

// common uses

Auditing whether an inherited database uses an adequate work factor Understanding what a $argon2id$ string in a config or migration actually configures Explaining bcrypt cost to a teammate during a code review Deciding whether a legacy hash format needs a migration plan

// faq

Can this crack a password or tell me what the password was?

No, and it is not designed to. A password hash is one-way by construction. This tool only reads the parameters that are stored in plain sight alongside the digest, namely the algorithm, the cost settings and the salt. There is no password field, and nothing is checked against the digest.

Why is the salt stored right there in the hash?

Because a salt is not a secret. Its job is to make sure two people with the same password get different hashes, which defeats precomputed rainbow tables. It only needs to be unique and random, not hidden, so every one of these formats stores it inline.

What does the bcrypt cost number actually mean?

It is an exponent. Cost 12 means 2^12 = 4,096 iterations of the key schedule. Every increase of one doubles the work: for you on login, and for anyone attacking the hash. That is the whole point: you pick the largest number your login latency budget can afford.

Which formats does it recognise?

bcrypt ($2a$/$2b$/$2y$), Argon2id/Argon2i/Argon2d, SHA-512-crypt ($6$), SHA-256-crypt ($5$), MD5-crypt ($1$), and PBKDF2 in the Django/passlib format. These all embed their own salt and cost parameters. A bare MD5 or SHA-256 digest has none of that, so use the hash identifier for those.

Is the hash I paste sent anywhere?

No. Parsing happens entirely in your browser, which matters here more than on most tools, since a production password hash is exactly the sort of thing that should never be pasted into a server you do not control.

// works with your data

Hash Identifier SHA-256 Hash Generator MD5 Hash Generator Hash Generator SHA-512 Hash Generator SHA-1 Hash Generator

Use this via API

Get a free API key →

curl -X POST https://thesnaptools.com/api/v1/tools/password-hash-explain \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"text":"$2b$12$LQv3c1yqBWVHxkd0LHAkCOYz6TtxMQJqhN8/LewdBPj/HcNbLuLLu"}'