Bcrypt Generator & Verifier
Generate bcrypt password hashes and verify passwords against existing hashes. All processing runs in your browser.
About This Tool
The Bcrypt Generator & Verifier is a free browser-based tool for hashing passwords with the bcrypt algorithm and verifying plaintext passwords against existing bcrypt hashes. Bcrypt is the industry-standard password hashing function designed to be deliberately slow, making brute-force attacks computationally expensive and impractical.
Unlike fast hash functions such as SHA-256 (available in our Hash Generator), bcrypt incorporates a cost factor (salt rounds) that controls how many iterations of the underlying Blowfish cipher are performed. Each increment of the cost factor doubles the computation time, so a cost factor of 12 is four times slower than 10. This adaptive slowness is what makes bcrypt ideal for password storage — as hardware gets faster, you simply increase the cost factor.
The Generate tab lets you enter a password and select a
cost factor between 4 and 16. The resulting hash includes the
algorithm identifier ($2a$ or $2b$), the cost
factor, a 22-character Base64-encoded salt, and the 31-character
hash — all in a single 60-character string. The Verify
tab lets you check whether a plaintext password matches an
existing bcrypt hash, which is useful for debugging
authentication systems.
All processing happens entirely in your browser using a pure-JavaScript bcrypt implementation. No passwords or hashes are ever sent to any server. For generating strong passwords to hash, try the Password Generator.
How to Use
- Open the Generate tab to create a new bcrypt hash.
- Enter the password you want to hash in the Password field.
- Select the desired Salt Rounds (cost factor). The default of 10 is suitable for most applications; increase to 12 or higher for sensitive systems.
- Click Generate Hash or press Ctrl+Enter. The bcrypt hash and generation time appear below.
- Click the copy icon or press Ctrl+Shift+C to copy the hash to your clipboard.
- Switch to the Verify tab to check a password against an existing hash.
- Enter the plaintext password and paste the bcrypt hash, then click Verify to see whether they match.
FAQ
Is my data safe?
Yes. All hashing and verification runs entirely in your browser using a pure-JavaScript bcrypt implementation. No passwords, hashes, or any other data are sent to any server.
What salt rounds should I use?
A cost factor of 10 is the default and provides a good balance of security and speed. For high-security applications such as banking or medical systems, consider using 12 or higher. Each increment doubles the computation time, so test performance on your target hardware before deploying.
What is the difference between $2a$ and $2b$?
$2a$ is the original bcrypt identifier and $2b$ is a corrected version that fixes a minor implementation issue in certain libraries. In practice, both produce compatible hashes and modern bcrypt libraries handle both identifiers correctly.
Why is bcrypt better than SHA-256 for passwords?
SHA-256 is designed to be fast, which makes it efficient for checksums but terrible for password storage — an attacker can compute billions of SHA-256 hashes per second. Bcrypt is deliberately slow and includes a configurable cost factor, making brute-force attacks orders of magnitude more expensive.
Can I use this hash directly in my database?
Yes. The 60-character bcrypt hash string contains all the information needed for verification: the algorithm version, cost factor, salt, and hash. You can store it directly in a VARCHAR(60) or TEXT column and use any bcrypt library in your backend to verify passwords against it.
Why does hashing take longer with higher salt rounds?
Each salt round increment doubles the number of internal iterations of the Blowfish cipher. At round 10, bcrypt performs 2^10 (1,024) iterations; at round 16, it performs 2^16 (65,536) iterations — 64 times more work. This is by design, as it makes brute-force attacks proportionally harder.
Related Tools
Hash Generator
Generate MD5, SHA-1, SHA-256, and SHA-512 hashes for text and files.
Password Generator
Generate secure passwords and passphrases with entropy-based strength analysis.
Password Strength Analyzer
Analyze password strength with entropy calculation, pattern detection, and time-to-crack estimation.
HMAC Generator
Generate HMAC signatures using MD5, SHA-1, SHA-256, SHA-384, and SHA-512 with hex or Base64 output.
Text Encrypt / Decrypt
Encrypt and decrypt text with AES-256-GCM using a password. All processing in your browser.