Bcrypt Hash Generator
Hash a password with bcrypt at cost 4–14, or paste a hash and a password to check whether they match.
bcrypt
Enter a password and press the button.
About this tool
Bcrypt is the long-standing recommendation for storing passwords. Unlike a plain SHA hash it is deliberately slow and includes a random salt, so identical passwords produce different hashes and brute-force attacks are expensive. The cost factor doubles the work with every increment: cost 10 takes around 100 ms on a laptop, cost 12 about half a second.
Developers use this tool to seed a database with a known password, to check what a stored hash corresponds to during debugging, or to test login code. The hash format $2a$/$2b$ is compatible with PHP's password_hash, Python's bcrypt, Spring Security and Node's bcrypt libraries.
Frequently asked questions
- Why is the hash different each time?
- Each hash contains a random 16-byte salt. Verification still succeeds because the salt is stored inside the hash.
- Which cost should I use in production?
- 10 to 12 today; raise it as hardware gets faster. Measure so a login stays under about half a second.
- Are my passwords sent anywhere?
- No. Hashing runs in your browser with bcryptjs.