Bcrypt Hash Generator and Verifier

Developer

A bcrypt generator hashes a password with the bcrypt algorithm (random salt plus a tunable cost factor) and verifies whether a password matches a given hash.

Bcrypt Hash Generator and Verifier

Runs in this browserThe password and hash are processed only in this browser and never sent to a server.

Avoid typing production passwords on shared machines or during screen sharing.

Password

Cost (rounds)

Higher cost values take longer (each +1 doubles the time).

What is it

bcrypt is a password hashing function from 1999 built on the Blowfish cipher and deliberately slow to raise the cost of brute-force attacks. Each +1 on the cost factor doubles the work, and every hash embeds a random salt, so the same password produces a different hash each time. This tool runs the bcryptjs library inside your browser, so the password never leaves your device. Use it to create test-account hashes during development or to check a hash stored in your database.

bcrypt = EksBlowfish(cost, salt, password) — format $2b$[cost]$[22-char salt][31-char hash], iterations = 2^cost

How to use

1In generate mode, enter a password and pick the cost (rounds) to create a hash.
2In verify mode, enter the password and the existing bcrypt hash.
3Copy the resulting hash or read the match result.

Reference

Bcrypt Hash Generator and Verifier Reference
Part	Meaning
$2b$	Algorithm identifier (current bcrypt revision)
10$	Cost — 2^10 = 1,024 iterations
Next 22 chars	128-bit random salt (base64-encoded)
Last 31 chars	184-bit hash output (checksum)

Sources & standards

A Future-Adaptable Password Scheme (bcrypt) - USENIX
OWASP Password Storage Cheat Sheet - OWASP
MDN Web Docs: Client-side web APIs - MDN Web Docs

FAQ

Is my password sent to a server?

No. The bcryptjs library runs inside your browser, so both hashing and verification are local — the password and hash are never transmitted or stored. Still, avoid typing production passwords on shared machines or during screen sharing.

Why is the hash different every time for the same password?

Because a fresh random salt is generated and embedded in each hash. Verification reuses the salt stored inside the hash string, so any of those hashes compares correctly.

What cost (rounds) should I use?

Typically 10–12. Each increment doubles the time, so aim for roughly 100–300ms per hash on your server hardware.

Is there a password length limit?

bcrypt only uses the first 72 bytes of input and silently ignores the rest. This tool warns when a password exceeds 72 UTF-8 bytes.