Bcrypt Hash Generator and Checker
Generate bcrypt hashes with a configurable cost factor, and verify a password against an existing hash. Free, and computed in your browser.
Input
Result
The result appears here as you type.
What this tool is for
Bcrypt is a password hash rather than a general purpose one: it is deliberately slow, it salts every hash automatically, and its cost factor can be raised as hardware gets faster. Use it to seed a test user, to check a hash from a database, or to see what a cost increase does to hashing time.
How to use it
- Enter the password and choose a cost factor: 10 to 12 suits most applications.
- Copy the resulting hash, which already contains its own salt.
- To verify, paste an existing hash and a candidate password into the check fields.
Frequently asked questions
Why does the same password produce a different hash each time?
Because a fresh random salt goes into every hash. That is the point: identical passwords in a database must not produce identical rows. Verification still works because the salt is stored inside the hash string.
What cost factor should I use?
High enough that one hash takes roughly 250 milliseconds on your production hardware, which today usually means 11 or 12. Each step up doubles the work for you and for an attacker.
Is bcrypt still the right choice?
It remains solid and well supported. Argon2id is the current recommendation for new systems because it resists GPU attacks better, but bcrypt is a long way from being a weakness.