Bcrypt Hash Generator & Verifier

Hash passwords with bcrypt at any cost factor, and verify a password against an existing hash - Computed entirely in your browser.

Cost factor (rounds) 2^cost iterations - Each +1 doubles the work
10

Cost 10 ≈ 65ms per hash on a typical laptop - The common production default.

Verify a password against a hash

Why Bcrypt Instead of MD5 or SHA-256?

Deliberately slow, by design

General-purpose hashes like MD5 and SHA-256 are built for speed - A single GPU tests billions of them per second, which is catastrophic for stored passwords. Bcrypt is the opposite: its cost factor makes each guess take a tunable amount of real time, and doubling the cost doubles the attacker's bill.

Bcrypt also salts automatically - The 22-character salt is embedded right in the hash, so two users with the same password get completely different hashes and rainbow tables are useless.

Reading a bcrypt hash

$2b$10$N9qo8uLOickgx2ZMRZoMye…

  • $2b$ - The bcrypt version identifier (2a, 2b and 2y are compatible variants).
  • 10 - The cost factor: 210 = 1,024 rounds of key setup.
  • The next 22 characters - The random salt.
  • The remaining 31 - The actual hash.

Because the salt and cost travel inside the hash, verification needs no extra stored data - Which is what the verifier above does.

One quirk worth knowing: bcrypt only reads the first 72 bytes of the password. For normal passwords that's irrelevant; for machine-generated secrets, keep them under 72 characters or pre-hash them.

How to Use the Bcrypt Hash Generator

1

Enter the password

Type or paste the password or secret you want to hash - It never leaves your browser.

2

Pick a cost factor

10 is the common production default; 12 is a strong modern choice. Each +1 doubles the computation time for you AND every attacker.

3

Generate and copy

The output embeds its own random salt, so hashing the same password twice gives different, equally valid hashes.

4

Verify when needed

Paste any bcrypt hash plus a candidate password into the verifier to check whether they match.

Bcrypt cost factor vs. work and attacker throughput (typical 2026 hardware)

CostIterationsTime per hashSingle-GPU guesses/secUse case
416~1 ms~350,000Tests only - Never production
8256~16 ms~22,000Legacy floor, now below OWASP minimum
101,024~65 ms~5,500Common production default
124,096~260 ms~1,400Strong modern choice
1416,384~1 s~350High-security applications
1532,768~2 s~175Maximum practical for login flows

Bcrypt Hash Generator - FAQ

Is it safe to type a real password into this tool?
The hashing runs entirely in your browser via a bundled bcrypt implementation - No network request carries your input anywhere, which you can verify in devtools. That said, for production secrets the best practice is to hash server-side in your application code, not through any website.
Why do I get a different hash every time for the same password?
That's bcrypt working correctly: each hash embeds a fresh random salt. Any of those hashes verifies against the original password - The verifier reads the salt back out of the hash itself. Two users with the same password therefore never share a hash.
What cost factor should I use in production?
OWASP recommends a minimum of 10; 12 is a comfortable modern choice if your servers can absorb ~250ms per login. Benchmark on your real hardware and pick the highest cost your login latency budget tolerates - Then revisit it every couple of years as hardware speeds up.
Should I use bcrypt or Argon2 for a new project?
Argon2id is the current state of the art because its memory-hardness also blunts GPU and ASIC attacks, and it won the Password Hashing Competition. Bcrypt remains a solid, battle-tested choice with universal library support. Both are fine; unsalted MD5 or SHA-256 are not - See our Argon2 vs bcrypt vs scrypt guide.

More questions about passwords and security? Browse the security guides.

More Free Tools

Password Generator →

AES-256 Encryption

Encrypt and decrypt text with AES-256, right in your browser.

MD5 Hash Generator

Compute MD5 checksums of any text instantly.

SHA-256 Hash Generator

SHA-256, SHA-384 and SHA-512 hashes computed locally.

Base64 Encoder / Decoder

Encode and decode Base64 text and URLs.

UUID Generator

Random version-4 UUIDs, one or in bulk.

Case Converter

UPPER, lower, Title, camelCase and more.