Bcrypt Hash Generator
Hash a password with bcrypt, or verify a password against an existing bcrypt hash — instantly inside your browser.
What is bcrypt?
Bcrypt is a password hashing algorithm purpose-built for storing passwords securely — unlike a general-purpose hash like SHA-256, bcrypt is deliberately slow, and its "cost" (salt rounds) can be tuned to stay slow even as hardware gets faster. It also automatically generates and embeds a random salt in every hash, so identical passwords never produce identical hashes.
This tool hashes a password with bcrypt, and can also verify whether a password matches an existing bcrypt hash.
GuideHow to use it
How bcrypt hashing works
Bcrypt generates a random 16-byte salt, then runs the password through the Blowfish-based hashing algorithm for 2^rounds iterations — higher salt rounds mean exponentially more computation, which is exactly what makes it resistant to brute-force attacks. The salt, cost, and resulting hash are all encoded together into the final bcrypt string, so nothing extra needs to be stored separately to verify it later.
Why it helpsFeatures & benefits
Why this runs entirely in your browser
Passwords are sensitive by nature, so hashing and verification both run locally in JavaScript in the tab, and nothing typed here is ever sent to a server.
Common uses
Generating a bcrypt hash to store in a database or config file, testing whether a known password matches a stored hash, or learning how bcrypt's salt and cost factor work.
Frequently asked questions
A few things people usually want to know before trusting the numbers.
10 is a common, reasonable default for most applications. Higher values (12-14) are more secure but slower to compute — the right balance depends on your server's performance and how many logins it needs to handle.
That's by design. A fast hash lets an attacker try billions of password guesses per second if a database leaks; bcrypt's deliberate slowness makes large-scale guessing far more expensive.
Bcrypt generates a new random salt for every hash, which is embedded in the output — that's why identical passwords never produce identical hashes, and why Verify mode is needed to check a match rather than comparing hashes directly.
It extracts the salt and cost from the hash you provide, re-hashes your password with those same parameters, and checks whether the result matches.
No. All hashing and verification happen locally in your browser. Nothing typed here is sent to a server, stored, or shared.