Bcrypt Generator & Checker
Hash a password with bcrypt at a cost factor you choose, or check a password against an existing bcrypt hash — all in your browser.
About the Bcrypt Generator & Checker
This bcrypt tool hashes a password with the bcrypt algorithm and verifies a password against an existing hash — both entirely in your browser. Choose a cost factor (work factor) to control how slow, and therefore how brute-force-resistant, the hash is, and get a standard $2a$/$2b$ bcrypt string you can store or compare.
Bcrypt is the go-to algorithm for password storage because it's deliberately slow and includes a built-in salt, so identical passwords produce different hashes and precomputed-hash attacks fail. The checker recomputes with the salt embedded in the hash to confirm a match.
Everything runs locally with a self-contained bcrypt implementation — no password or hash is uploaded. It's ideal for testing authentication code, generating a hash for a config or seed, and understanding how bcrypt works.
How to Use the Bcrypt Generator & Checker
- 1To hash: enter a password, pick a cost factor, and generate the bcrypt hash.
- 2Copy the hash to store it in your database or config.
- 3To check: paste a password and an existing bcrypt hash.
- 4Verify to see whether they match.
Frequently Asked Questions
What is the bcrypt cost factor?
The cost (or work factor) sets how many rounds of key expansion bcrypt performs — 2 to the power of the cost. Each increment doubles the time to compute the hash, making brute-force attacks proportionally harder. Cost 10–12 is common today; higher is safer but slower, so balance security against your server's login latency.
Why does the same password produce different hashes?
Bcrypt generates a random salt for every hash and embeds it in the output string. Because the salt differs, hashing the same password twice gives different results — which is exactly what you want, since it defeats rainbow tables. Verification still works because the salt travels inside the hash.
How does checking a password work if hashes differ?
The bcrypt hash string contains the cost and the salt used. To verify, the tool extracts those, re-hashes your candidate password with the same salt and cost, and compares. A match means the password is correct. That's how login systems check passwords without ever storing them in plain text.
Is it safe to enter a real password here?
The hashing and checking run entirely in your browser and nothing is uploaded. Still, as good practice, avoid pasting production passwords into any web tool. Use it for testing, development hashes and learning, where using a throwaway value carries no risk.
Which bcrypt variant does it produce?
A standard modular-crypt string beginning with $2a$ or $2b$, the widely-compatible variants that libraries like bcrypt (Node), passlib (Python) and Spring Security accept. The cost and 22-character salt are encoded in the prefix, followed by the hash.