Bcrypt Generator
Generate bcrypt password hashes with a cost factor you choose, and verify a password against an existing hash. Everything runs locally in your browser.
Generate a hash
Higher is stronger but slower. 12 and above get slow in the browser.
Verify a password
Why bcrypt beats a fast hash
A password store should be slow to attack, not fast to compute. General-purpose hashes like MD5, SHA-1 and SHA-256 are built for speed, so a modern GPU can test billions of candidates a second against a stolen database. Bcrypt flips that: its work factor (the cost) forces a deliberate amount of computation per hash, and you raise it as hardware gets faster. That single knob is what keeps a leaked table from being cracked overnight.
Reading the hash
A bcrypt hash is one self-describing string, for example
$2b$10$N9qo8uLOickgx2ZMRZoMye.... Split on the dollar signs and it reads:
- $2b$ - the algorithm and version tag.
- 10 - the cost factor, meaning 2^10 = 1024 key-setup rounds.
- The next 22 characters - the random salt, base64-encoded.
- The final 31 characters - the hash of your password with that salt.
Because the salt lives inside the string, you never store it separately, and verification needs nothing but the hash and the password to check.
Choosing a cost factor
Cost 10 to 12 is the usual server-side range. Every increment doubles the work, so going from 10 to 13 makes each hash roughly eight times slower. Aim for a cost where a single hash takes somewhere around 100 to 250 milliseconds on your production hardware: slow enough to blunt brute force, fast enough that logins stay snappy. This page runs in JavaScript, which is slower than a native library, so cost 12 and up will feel sluggish here even though a real server would breeze through them.
For non-password hashing, reach for the SHA hash generator instead. If you are debugging auth tokens, the JWT decoder and JWT generator are close companions.