Bcrypt Generator - Hash and Verify Passwords Online

🔗 Related Tools

What is a Bcrypt Generator?

A bcrypt generator turns a text, usually a password, into a bcrypt hash. A hash is a fixed-length string that stands in for the original text. Websites and apps store the hash instead of the password itself, so that a stolen database does not directly reveal everyone's passwords. When a user logs in, the app hashes the typed password again and compares the result with the stored hash.

Bcrypt is made for this job. It is slow on purpose, it adds a random salt to every hash, and you can make it slower as computers become faster. This tool lets you create bcrypt hashes with the cost you choose and check a text against an existing hash.

How to Generate a Bcrypt Hash

1. Open the Generate Hash tab.
2. Type your test text or password. Use the eye button if you want to see what you typed.
3. Choose the salt rounds (cost factor). A common choice is between 10 and 12.
4. Click Generate. A spinner is shown while the hash is calculated, and higher values take longer.
5. Click Copy to copy the hash.

How to Verify a Bcrypt Hash

1. Open the Verify Hash tab.
2. Enter the plain text in the first box and paste the bcrypt hash in the second box.
3. Click Verify.
4. A green tick with Match means that the text produces that hash. A red cross with Does not match means that it does not.

Paste the hash without spaces or line breaks before or after it. A valid bcrypt hash is 60 characters long.

What You See on the Page

Item	Meaning
Generate Hash tab	Creates a new bcrypt hash from your text
Verify Hash tab	Checks whether a text matches a bcrypt hash
Salt rounds (cost factor)	Sets how much work the hash needs. Each step up doubles it
Show / hide (eye) button	Shows or hides the text you typed
Spinner	Shows that a hash is still being calculated, mostly with higher cost values
Copy button	Copies the generated hash
Green tick (Match)	The text and the hash belong together
Red cross (Does not match)	The text and the hash do not belong together

What a Bcrypt Hash Looks Like

A bcrypt hash always has the same layout and is 60 characters long. The example below is made-up placeholder text that only shows the layout. It is not the hash of a real password.

$2b$10$abcdefghijklmnopqrstuvABCDEFGHIJKLMNOPQRSTUVWXYZ01234

Part	In the example	Meaning
Version marker	$2b$	Tells which bcrypt version made the hash. You may also see $2a$ or $2y$
Cost factor	10	Two digits. The number of rounds is 2 to the power of this number
Separator	$	A dollar sign between the cost and the salt
Salt	22 characters	The random salt, stored inside the hash so that it can be used again for checking
Hash	31 characters	The result of the calculation

The hash can contain letters, digits, dots and slashes. Because the salt and the cost are inside the hash, you only need to store one string.

Salt Rounds (Cost Factor) Explained

The cost factor is a number. The algorithm repeats its work 2 to the power of that number, so every increase of 1 doubles the work and roughly doubles the time. A higher cost makes each password guess slower for an attacker, and it also makes each login slower for you.

Cost	Rounds (2 to the power of cost)	Time compared with cost 10 (approximate)
10	1,024	1x
11	2,048	2x
12	4,096	4x
13	8,192	8x
14	16,384	16x
15	32,768	32x

The real time depends on your device and on the library. Browser code is often slower than native code on a server, so high values can take a noticeable moment here. This is why a spinner is shown.

Which cost should you choose?

• Many applications use a value around 10 to 12. Security guidance such as the OWASP Password Storage Cheat Sheet suggests a cost of at least 10 for bcrypt.
• Tune it on your own server. Pick the highest value that keeps a login fast enough for your users, and test with your real hardware.
• Raise it over time. As computers get faster, increase the cost for new hashes.
• Remember that every login pays the cost. A very high value can slow down your server and make it easier to overload with login requests.

Why the Same Password Gives a Different Hash

Every time bcrypt creates a hash, it first makes a new random salt and mixes it into the calculation. The salt is stored inside the hash. So if you generate a hash for the same text twice, you get two different hashes, and both are correct.

• Do not compare two hashes as text. Two different hashes of the same password will not be equal as strings.
• Use a verify or compare function. It reads the salt and cost from the stored hash, hashes the typed password with them and compares the results.
• Why salt matters: Users who choose the same password still get different hashes, and attackers cannot use one precomputed table of hashes for everybody.

How Verification Works

1. The tool reads the version, the cost and the salt from the stored hash.
2. It hashes the text you typed using the same version, cost and salt.
3. It compares the new result with the hash you pasted.
4. If they are the same, the text is a match. If not, it does not match.

The original password is never read back from the hash. A hash cannot be decrypted.

Can a Bcrypt Hash Be Decrypted?

No. Bcrypt is a one-way function, and a hash is not encrypted data, so there is no key and nothing to decrypt. The only way to find the text behind a hash is to guess it: try a possible password, hash it with the same salt and cost and see if the result is the same. Bcrypt makes every guess slow, but weak, short or common passwords are still found quickly. A good, long and unique password is what keeps an account safe.

The 72-Byte Limit

Bcrypt only uses the first 72 bytes of the input, and most implementations ignore anything after that. This is a limit of the algorithm.

Character	Bytes in UTF-8
Plain English letters, digits and common symbols	1
Many accented letters	2
Many Indian-language characters, such as Devanagari	3
Emoji	4

• Two inputs that are the same in their first 72 bytes give the same result, even if they differ after that.
• A password with many non-English characters or emoji reaches 72 bytes in fewer than 72 characters.
• Some applications work around this by preparing long passwords before hashing, which needs care to do safely. Follow the advice for your framework.

Bcrypt Versions: $2a$, $2b$ and $2y$

Marker	Where you see it
$2a$	Very common in many libraries and older systems
$2b$	A later version marker that many current libraries use
$2y$	The marker that PHP uses

Most current libraries can verify all of these, but check the documentation of your own library. If a hash from another system does not verify, look at the marker first.

Bcrypt in Your Own Code

These short examples use well-known libraries. Use test passwords while you try them, and follow the documentation of the library version you install.

Node.js (bcryptjs)

const bcrypt = require("bcryptjs");

const hash = await bcrypt.hash("my-test-password", 12);
const isMatch = await bcrypt.compare("my-test-password", hash);

Python (bcrypt)

import bcrypt

password = b"my-test-password"
hashed = bcrypt.hashpw(password, bcrypt.gensalt(rounds=12))
is_match = bcrypt.checkpw(password, hashed)

PHP

$hash = password_hash("my-test-password", PASSWORD_BCRYPT, ["cost" => 12]);
$is_match = password_verify("my-test-password", $hash);

Bcrypt vs Other Ways to Hash Passwords

Method	What to know	Good for storing passwords?
Bcrypt	Slow on purpose, adjustable cost, built-in salt, 72-byte input limit, supported almost everywhere	Yes
Argon2id	A newer password hashing algorithm that also needs a lot of memory, which makes guessing harder on special hardware. Security guidance such as OWASP's lists it as the first choice when it is available	Yes
scrypt	Another slow, memory-heavy password hashing algorithm	Yes
PBKDF2	Older and widely available, often used where a standard or a rule requires it	Yes, with a high enough iteration count
SHA-256, SHA-512	Fast general-purpose hashes made for checking data, not for protecting passwords	Not on their own
MD5, SHA-1	Fast and broken for security use	No

If you need MD5 or SHA hashes for checksums or file checks, use the Hash Generator instead. Those are different tools for a different job.

Tips for Using Bcrypt Correctly

• Hash passwords on your server. Hashing in the browser and sending only the hash does not replace server-side hashing, because the hash itself would then work as the password.
• Never store or log plain passwords.
• Use HTTPS so that passwords are not sent over the network in plain form.
• Use a well-tested library. Do not write your own bcrypt or your own password hashing.
• Let the library make the salt. Do not reuse one salt for all users, and do not invent your own salt.
• Compare with the verify function, not with a string comparison of hashes.
• Plan to raise the cost. When a user logs in, you can create a new hash with a higher cost and save it.
• Limit login attempts and think about extra protection such as two-step verification.
• Check the 72-byte limit for your users, especially when you allow long passphrases or many non-English characters.

Common Mistakes

• Comparing two hashes as text: The same password gives a different hash each time. Use verify.
• Treating a hash as encryption: A hash cannot be decrypted, so you cannot get the password back.
• Using MD5 or SHA-256 alone for passwords: They are too fast.
• Setting the cost too low or too high: Too low makes guessing easy. Too high slows every login and can overload a server.
• Copying extra spaces or line breaks: They make a correct hash fail to verify.
• Ignoring the 72-byte limit: Everything after 72 bytes is ignored by most implementations.
• Pasting real production passwords into an online tool: Use test values.
• Rolling your own password hashing: Use an established library.

Good to Know

• The tool makes standard bcrypt hashes that bcrypt libraries in other languages can check, as long as the marker and cost are supported by your library.
• Hashing the same text twice gives two different valid hashes.
• Higher cost values take longer in the browser than on a typical server.
• The tool is for testing, learning and quick checks. It does not store anything for you.

Privacy and Safety

• The hashing runs in your browser using JavaScript, and what you type is not sent to our server.
• Browser extensions, shared or public computers and clipboard history can still expose what you type or copy.
• Use test passwords. Do not enter real production passwords, and avoid pasting hashes from a live database.
• If you work on a shared computer, close the page and clear the clipboard when you finish.
• Bcrypt is one part of password safety. It does not make a weak password strong.

Frequently Asked Questions

How do I generate a bcrypt hash?

Open the Generate Hash tab, type your text or password, choose the salt rounds (cost factor) and click Generate. The bcrypt hash appears below, and you can copy it with the Copy button. A higher cost takes longer to calculate, so a spinner is shown while the tool works.

What is bcrypt?

Bcrypt is a password hashing algorithm based on the Blowfish cipher. It is designed to be slow on purpose and to include a random salt, which makes it much harder to guess passwords from stolen hashes than with fast hashes such as MD5 or SHA-256. It is widely supported in programming languages and frameworks.

What are salt rounds (cost factor), and which value should I choose?

The cost factor sets how much work is needed to calculate a hash, and each increase of 1 doubles the work. A higher value makes guessing attacks slower but also makes every login slower. Many applications use a value around 10 to 12, and security guidance such as the OWASP Password Storage Cheat Sheet suggests at least 10. Pick a value that is slow enough to matter but still fast enough for your server and your users, and raise it over time as hardware improves.

Why do I get a different hash every time for the same password?

Bcrypt adds a new random salt every time it creates a hash, and the salt is stored inside the hash itself. So the same password gives a different hash each time, and all of them are valid. To check a password, use the Verify Hash tab or the compare function of your bcrypt library, not a text comparison of two hashes.

How do I verify a password against a bcrypt hash?

Open the Verify Hash tab, enter the plain text and paste the bcrypt hash, then click Verify. A green tick means they match and a red cross means they do not. Behind the scenes, the tool reads the cost and the salt from the hash, hashes your text with them and compares the result with the hash.

Can a bcrypt hash be decrypted or reversed?

No. A bcrypt hash is a one-way result and it is not encrypted data, so there is nothing to decrypt. The only way to find the original text is to guess it, hash each guess and compare. This is why weak and common passwords are still unsafe, even when they are hashed with bcrypt.

What does a bcrypt hash look like?

A bcrypt hash is 60 characters long and has a fixed layout. It starts with a version marker such as $2b$, then the cost as two digits, then a dollar sign, then 22 characters of salt and 31 characters of hash. It can contain letters, digits, dots and slashes.

What is the 72-byte limit in bcrypt?

Bcrypt only uses the first 72 bytes of the input, and most implementations ignore anything after that. Bytes are not the same as characters: a plain English letter takes one byte, but many accented letters take two and emoji take four in UTF-8. Two passwords that are the same in their first 72 bytes give the same result, even if they differ after that. Very long passphrases need extra care in your application.

What is the difference between $2a$, $2b$ and $2y$ in a bcrypt hash?

They are version markers at the start of the hash. $2a$ and $2b$ are the most common, and $2b$ is the later one. $2y$ is the marker that PHP uses. Most current libraries can verify all three, but check the documentation of your own library.

Why does a higher cost factor take longer?

Each step up in cost doubles the number of rounds the algorithm has to run, so the time roughly doubles too. Browser code is often slower than native code on a server, so high values can take noticeably longer here. The tool shows a spinner while it works.

Is it safe to type my password here?

The hashing runs in your browser using JavaScript, and what you type is not sent to our server. Even so, treat any online tool with care, because browser extensions, shared computers and clipboard history can expose what you type. Use test passwords, and do not enter real production passwords.

Why do I get Does not match when I am sure the password is right?

The most common causes are an extra space or line break copied with the text or the hash, a hash that was cut short, a different password than you think, or a hash that is not a bcrypt hash at all. Also remember the 72-byte limit and differences in how a program turned the password into bytes. Copy the hash again and try once more.

Is bcrypt better than MD5 or SHA-256 for passwords?

Yes. MD5 and SHA-256 are designed to be fast, which helps attackers who try huge numbers of guesses. Bcrypt is designed to be slow and adjustable, so each guess costs more. For storing passwords, use a password hashing algorithm such as bcrypt, or a newer one such as Argon2id, and not a plain fast hash.

Is this bcrypt generator free?

Yes. The tool is free and needs no signup.