bcrypt Hash Regex for JavaScript

What this pattern does

This page provides a well-structured, multi-part regular expression for matching bcrypt hash, ported and verified for JavaScript. In security-sensitive code, using an unverified regex can open the door to both false positives and denial-of-service attacks. The snippet below is ready to drop into your JavaScript project — whether you're validating in an Express middleware, a Next.js API route, or a client-side form.

Javascript Implementation

// bcrypt Hash
// ReDoS-safe | RegexVault — Security > Password Formats

const bcryptHashRegex = /^\$2[ayb]\$([0-2][0-9]|3[0-1])\$[.\/A-Za-z0-9]{53}$/;

function validateBcryptHash(input: string): boolean {
  return bcryptHashRegex.test(input);
}

// Example
console.log(validateBcryptHash("$2b$12$EixZaYVK1fsbw1ZfbX3OXePaWxn96p36WQoeG6Lruj3vjPGga31lW")); // true

Test Cases

When to use this pattern

This pattern is drawn from the Security > Password Formats category and carries a ReDoS-safe certification. That matters for JavaScript developers because especially critical in long-running Node.js event loops where a ReDoS vulnerability can block the entire process. RegexVault audits patterns against known backtracking attack vectors, ensuring you have the necessary context before using this regex in a high-stakes production environment.

Common Pitfalls

Technical Notes

Structure: $2a/2b/2y$ + cost (4-31) + $ + 22-char salt + 31-char hash (in a modified base64 alphabet using ./A-Za-z0-9). $2b is the canonical prefix; $2a is legacy (PHP), $2y is PHP 5.3.7+. Cost of 10-12 is standard; use 12+ for new systems.