Bcrypt Hash Generator & Verifier
Hash a password with bcrypt and check whether it matches a stored hash. Everything runs in your browser, and your password and hash are never sent to a server. For plain hashes such as SHA-256, use the Hash Generator.
🔒 Runs in your browser · Your data is never sent to a server
Generate a hash
Each +1 roughly doubles the computation time. 12 and above can take several seconds.
Verify a hash
Notes
- bcrypt only uses the first 72 bytes of a password. Characters outside ASCII take 2-4 bytes each, so long non-ASCII passwords can hit the limit sooner. This tool refuses input over 72 bytes instead of silently truncating it.
- The salt is random every time, so the same password gives a different hash on each run. Use "Verify" to check for a match.
- A higher cost resists brute force better but also makes every login slower. A cost of about 10-12 is common in production.
- Prefer a test value over a real production password. Nothing you type is stored or sent, but be careful when sharing your screen.
Glossary
bcrypt
A hash function designed for storing passwords. It is deliberately slow, which raises the cost of brute-force attacks.
Cost factor (rounds)
Sets how heavy the computation is: the work is repeated 2^cost times. Cost 10 means 1,024 iterations and cost 12 means 4,096.
Salt
A random value mixed in each time a password is hashed. In bcrypt it is embedded in the hash string, so it does not need to be stored separately.
FAQ
Why is the hash different every time for the same password?
bcrypt mixes in a fresh random salt each time. That is normal, and comparing two hashes directly will not tell you whether they match. Use "Verify a hash" on this page, which extracts the salt from the stored hash and recomputes it.
What cost factor should I use?
Each +1 roughly doubles the computation time. A cost of about 10-12 is common today: slow enough to hinder brute force without making logins sluggish. Pick a value that takes roughly 100-500 ms per hash on your server. This tool limits the range to 4-14 because it runs in the browser.
Is there anything to watch out for with long or non-ASCII passwords?
bcrypt only uses the first 72 bytes. Many non-ASCII characters take 2-4 bytes each (3 for most CJK characters, 4 for emoji), so a long password can be cut off earlier than you expect. This tool rejects input over 72 bytes. Some systems pre-hash long passwords with SHA-256 first, but both sides must do the same.
What is the difference between $2a$, $2b$ and $2y$?
They are version labels from different implementations and give the same result in current implementations. This tool can verify $2a$, $2b$ and $2y$ hashes, and generates hashes in the $2b$ form.
Share this page