Securityflags: g

bcrypt Password Hash

Match bcrypt password hashes in their canonical $2a$/$2b$/$2y$ prefixed format.

Available in

JavaScript / ECMAScript code

jsJavaScript

const re = new RegExp("\\$2[abxy]?\\$\\d{2}\\$[./A-Za-z0-9]{53}", "g");
const input = "$2a$12$R9h/cIPz0gi.URNNX3kh2OPST9/PgBkqquzi.Ss7KIUgO2t0jWMUW";
const matches = [...input.matchAll(re)];
console.log(matches.map(m => m[0]));

Uses `String.prototype.matchAll` for global iteration (Node 12+ / all modern browsers).

Python (re) code

pyPython

import re

pattern = re.compile(r"\$2[abxy]?\$\d{2}\$[./A-Za-z0-9]{53}")
input_text = "$2a$12$R9h/cIPz0gi.URNNX3kh2OPST9/PgBkqquzi.Ss7KIUgO2t0jWMUW"
for m in pattern.finditer(input_text):
    print(m.group(0))

Stdlib `re` module — no third-party dependency. Works on Python 3.6+.

Go (RE2) code

goGo

package main

import (
	"fmt"
	"regexp"
)

func main() {
	re := regexp.MustCompile(`\$2[abxy]?\$\d{2}\$[./A-Za-z0-9]{53}`)
	input := `$2a$12$R9h/cIPz0gi.URNNX3kh2OPST9/PgBkqquzi.Ss7KIUgO2t0jWMUW`
	for _, match := range re.FindAllString(input, -1) {
		fmt.Println(match)
	}
}

Uses `regexp.MustCompile` (panics on bad patterns at startup) and `FindAllString` for all matches.

Pattern

regexengine-agnostic

\$2[abxy]?\$\d{2}\$[./A-Za-z0-9]{53}   (flags: g)

Raw source: \$2[abxy]?\$\d{2}\$[./A-Za-z0-9]{53}

How it works

Version prefix $2 with optional suffix letter, cost parameter (two digits), salt + hash encoded in bcrypt's base64 alphabet for a fixed 53 trailing characters.