Bcrypt Hash Generator & Checker
Hash a password with bcrypt, test whether a password matches an existing hash, or break a hash into its parts.
Generate a hash
Verify a password
Runs in your browser with bcryptjs; nothing is sent anywhere. Hashing runs in small steps so the page stays usable. Bcrypt is one-way: a hash cannot be “decrypted”, only checked against a guess.
How to generate and verify a bcrypt hash
- Type a password and choose the cost factor.
- Click Hash and copy the result.
- To check a hash, paste it with the password under Verify.
Features
- Hash with cost 4 to 14
- Time estimate and progress bar
- Verify a password against a hash
- Parse version, cost, salt and checksum
- 72-byte limit warning
- Keeps the page responsive while hashing
Frequently asked questions
What cost factor should I use?
Pick the highest cost your server can handle in about a quarter of a second per login. Cost 10–12 is common today. Each step up doubles the time for you and for an attacker.
Why does the same password give a different hash each time?
Bcrypt adds a random 128-bit salt, which is stored inside the hash. That is why you verify with a compare function instead of hashing again and comparing strings.
What do $2a$, $2b$ and $2y$ mean?
They are bcrypt versions. $2b$ is current; $2a$ is the older one (with a rare bug for some non-ASCII passwords); $2y$ is PHP’s name for the fixed version. All three verify the same way here.
Is there a password length limit?
Yes. Bcrypt uses only the first 72 bytes of a password. The tool warns you when a password is longer, which can happen sooner with Hindi, Telugu or emoji characters.
Is my password sent anywhere?
No. Hashing and checking happen in your browser using the open-source bcryptjs library.
Related tools
All Security & Privacy →- Hash Generator Calculate cryptographic hashes of text or any file and compare them with a published checksum.
- Password Generator Create strong, unique passwords for every account.
- API Key Generator Create random API keys, secrets and tokens from the browser’s secure random generator, one at a time or in bulk.
- Passphrase Generator Make a password you can actually remember, like “Crafty-Lemon-Uphill7-Banjo-Mystic”, that is still extremely hard to guess.
- Password Strength Checker See whether a password would survive a real attack.
- Password Breach Checker Find out whether a password has been exposed in a data breach.