Securityflags: g
bcrypt Password Hash
Match bcrypt password hashes in their canonical $2a$/$2b$/$2y$ prefixed format.
Try it in RegexProPattern
regexJavaScript
/\$2[abxy]?\$\d{2}\$[./A-Za-z0-9]{53}/gRaw source: \$2[abxy]?\$\d{2}\$[./A-Za-z0-9]{53}
How it works
Version prefix $2 with optional suffix letter, cost parameter (two digits), salt + hash encoded in bcrypt's base64 alphabet for a fixed 53 trailing characters.
Examples
Input
$2a$12$R9h/cIPz0gi.URNNX3kh2OPST9/PgBkqquzi.Ss7KIUgO2t0jWMUWMatches
$2a$12$R9h/cIPz0gi.URNNX3kh2OPST9/PgBkqquzi.Ss7KIUgO2t0jWMUW
Common use cases
- Detecting leaked hashes in dumps
- Secret scanning in configs
- Security audit of DB exports
- Migration tooling between hash formats