Bcrypt Generator & Verifier

Hash passwords with bcrypt and verify hashes — all client-side, nothing leaves your browser

Password & Options

Try a sample:
10

Higher cost = stronger hash but slower generation. Default 10 is a good balance; 12 is recommended for production.

Bcrypt Hash

Hash appears here

Enter a password and click Generate Hash

About Bcrypt

Bcrypt is the industry-standard password-hashing algorithm. Unlike fast hashing (MD5, SHA-256), bcrypt is deliberately slow: the cost factor (rounds) controls how many iterations are performed, making brute-force attacks computationally expensive. This tool generates bcrypt hashes and verifies passwords against existing hashes — all client-side in your browser, so your passwords never leave your device.

Examples

Hashing a password at cost factor 12

password: "MyS3cr3tP@ss"
rounds:   12
hash:     $2b$12$LQv3c1yqBWVHxkd0LHAkCOYz6TtxMQJqhN8/LewdBPj/hq3H8G2mO

A cost factor of 12 is the current production recommendation — it takes ~300 ms on modern hardware, which is fast enough for login flows but slow enough to deter offline cracking.

Verifying a password against a stored hash

password: "MyS3cr3tP@ss"
hash:     $2b$12$LQv3c1yqBWVHxkd0LHAkCOYz6TtxMQJqhN8/LewdBPj/hq3H8G2mO
result:   ✓ Match

bcrypt.compare() re-hashes the input with the salt embedded in the stored hash, then compares. A wrong password produces ✗ No match — no need to store the original password anywhere.

    About this tool

    Bcrypt is the industry-standard password-hashing algorithm, designed specifically to be slow and resistant to brute-force attacks. Unlike fast hashes such as MD5 or SHA-256, bcrypt incorporates a configurable cost factor that controls how many iterations are performed — making it exponentially harder for an attacker to crack a stolen database of hashes, even with modern GPU hardware.

    The Bcrypt Generator & Verifier gives you two operations in one tool. The Generate tab produces a bcrypt hash from any password, with a slider to choose the cost factor (rounds 4–15). The Verify tab accepts a plain-text password and a stored bcrypt hash and tells you instantly whether they match — exactly the operation a backend runs during login. The embedded salt means every generated hash is unique, even for the same password.

    Everything runs entirely in your browser using the bcryptjs library. No passwords, hashes, or any other input data are transmitted to a server, logged, or stored anywhere.

    How to use

    1. Hash a password

      Enter your password in the Generate tab, adjust the cost factor slider (4–15, default 10), and click Generate Hash. Copy the resulting bcrypt hash with the Copy button.

    2. Verify a password against a stored hash

      Switch to the Verify tab, paste the plain-text password and the stored bcrypt hash, then click Verify Password. Green means they match; red means they do not.

    3. Choose the right cost factor

      Use 10 for development and testing, 12 for production web apps, and 14+ only for scenarios where user-facing latency is not a concern.

    Bcrypt hash anatomy

    SegmentMeaning
    $2b$Algorithm version — 2b is the current recommended variant; 2a/2y are also accepted
    10$Cost factor — the number of hashing rounds (2^10 here)
    22 charsBase-64 encoded random salt — generated fresh for every hash
    31 charsBase-64 encoded hash output — the actual password digest

    The full hash is always exactly 60 characters for $2b$/$2a$/$2y$ variants.

    Frequently asked questions