Password-storage checker
Inspect how your application stores passwords. Choose your own CSV or JSON export to review recognised formats, stored cost settings and repeated salt values.
The file stays in this tab. Nothing is uploaded or saved automatically. Results contain aggregate counts, never usernames, passwords, hashes or salts. This tool inspects record formats; it does not test or recover passwords.
Export only the stored-password column and, if relevant, a separate salt column. CSV needs unique column headers; JSON needs an array of objects with string or null values. Up to 10,000 rows and 100 columns. SQL dumps and colon-separated credential lists are not supported.
Choose an export or try the fictional records.
What the records show
Salt observations
Next steps
Review unknown and malformed records with the application owner. For older settings, plan a tested migration through your authentication library. Check how salts are generated and whether a separately protected pepper is used. Benchmark changes on your own login service before rollout.
Matching a cost floor does not establish password strength, correct implementation, regulatory compliance or safety after a leak. This checker cannot observe a pepper, evaluate password reuse, prove salt randomness, or estimate cracking time. Repeated salt values may come from duplicate export rows.
Supported formats and limits
Argon2 PHC records and Django Argon2, bcrypt and Django bcrypt variants, Django PBKDF2-SHA256/SHA1 and scrypt, and explicit Werkzeug PBKDF2-SHA256/SHA512/SHA1 and scrypt layouts. Unknown formats and bare hexadecimal values remain unidentified. A familiar prefix is not proof that a record was genuinely generated by that library.
Argon2id checks use the listed single-lane cost profiles; other lane counts need manual review. Salt presence is observable in supported encodings, but the correctness of its use is not. The fictional example contains placeholder digests and is not a real breach dump.
Guidance checked 20 October 2026: OWASP password storage, Django formats, Werkzeug formats, Argon2 specification.