Skip to content
Devtoolry
Sign InJoin for Free

Bcrypt Hash Generator

Generate bcrypt password hashes with a chosen cost factor and verify a password against a hash online. Hashing runs in your browser, so nothing is uploaded.

Something not working, or missing a feature? Send feedback

About the Bcrypt Hash Generator

The Bcrypt Hash Generator creates bcrypt password hashes with the cost factor you choose and checks whether a password matches an existing hash. It also breaks a hash into its version, cost, salt and checksum, which helps when debugging logins or migrating password storage.

Everything is generated in your browser; nothing you enter is uploaded, and anything random comes from a cryptographically secure source.

How to use the Bcrypt Hash Generator

  1. Enter a password and choose the cost factor (10–12 is typical for web applications).
  2. Click Generate to create a hash; each run uses a new random salt.
  3. To check a password, paste it with a bcrypt hash into the Verify box and click Verify.

Common mistakes

  • Passwords longer than 72 bytes. bcrypt ignores everything after the first 72 bytes, so two long passwords with the same start hash the same. The tool warns when a password is longer.
  • Comparing hashes as strings. Never compare a freshly generated hash with a stored one: the salts differ, so they never match. Always use the library's compare or verify function.

Works well with the Bcrypt Hash Generator

Frequently asked questions

Why is the hash different every time?

bcrypt generates a random 128-bit salt for each hash and stores it inside the result. The same password therefore gives a different hash each time, and verification reads the salt back out of the hash.

Which cost factor should I use?

Choose the highest cost that keeps a login fast enough on your server, often around 100–300 ms. That is usually 10–12 today. Each step doubles the work, for you and for an attacker.

What do $2a$, $2b$ and $2y$ mean?

They are bcrypt versions. $2b$ is the current one; $2a$ is older, and $2y$ is what PHP produces. All three work the same way for normal passwords, and most libraries verify all of them.

Is it safe to hash a real password here?

Hashing runs entirely in your browser, so the password is not sent anywhere. Still, use test passwords for experiments rather than real credentials.

Related tools