Bcrypt Generator
Hash a password into a salted bcrypt digest, or check whether a password matches a hash you already have — both run locally using bcrypt.js, nothing is sent anywhere.
Overview
Bcrypt is a deliberately slow, salted hashing algorithm built for password storage — unlike a plain SHA hash, which is fast by design and therefore easy to brute-force at scale, bcrypt's cost factor controls exactly how slow it is, so it can be tuned to stay expensive for attackers as hardware gets faster. A fresh random salt is generated on every hash automatically, which is why hashing the same password twice produces two different-looking bcrypt strings — both still verify correctly.
Browsers don't implement bcrypt natively, so this tool loads bcrypt.js (a widely used, pure-JavaScript bcrypt implementation) to do the actual hashing and comparison locally — no server round-trip, no plaintext password transmitted.
Examples
Hashing a password at cost factor 10
Password: "correct horse battery staple", Rounds: 10
A $2a$10$-prefixed bcrypt string around 60 characters long — the exact digest differs on every run since bcrypt salts randomly, but any of them verifies correctly in Verify mode.
How It Works
- Choose Hash or Verify.
- Enter the password.
- For Hash, choose a cost factor (rounds) and click Run to get a bcrypt digest.
- For Verify, paste the existing bcrypt hash and click Run to see whether the password matches it.
FAQ
No. Hashing and verification both run entirely in your browser using bcrypt.js — the password and resulting hash never leave your device.
10–12 is a common default that balances hashing time against resistance to brute-force attempts; higher costs are slower but stronger. Note the cost factor only matters for Hash mode — verifying against an existing hash reads the cost factor already embedded in that hash.
Bcrypt generates a new random salt for every hash automatically, and embeds it in the output string. Different salts produce different-looking hashes for the same password, but the Verify mode still confirms a correct match against any of them.
Yes, specifically for passwords — SHA-256 (see Hash Generator) is fast by design, which makes it a poor fit for password storage since that speed also helps an attacker brute-force it. Bcrypt is deliberately slow and salted, which is exactly what password storage needs.