Read the guide
Make a password, then store the hash
Generate a random password, see what makes it weak, then store the bcrypt string. Argon2id is not available in this tool.
Bcrypt Hash Generator and Checker
Hash a password with bcrypt at the cost you choose, or check whether a password matches an existing bcrypt hash. Hashing runs in a background worker, so even cost 14 won't freeze the page.
Hashed in your browser. Passwords are never sent or stored.
- Bcrypt hash
- –
Runs in a background worker, so the page stays responsive.
How to use the Bcrypt Generator
- On the Hash tab, type the Password, pick the Cost and the Prefix your platform expects, and press Generate hash.
- Copy the Bcrypt hash. The time it took is shown below it.
- To check a password, open Verify, paste the password and the hash, and press Verify.
How it works
A bcrypt hash looks like $2y$10$ followed by 53 characters:
2yis the version,10is the cost, and the next 22 characters are a random 128-bit salt.- The last 31 characters are the hash, made by running the Blowfish key setup 2^cost times. Each step up in cost doubles the work, so cost 12 takes about four times as long as cost 10.
- Because the salt is random, hashing the same password twice gives two different hashes, and both verify.
- Verifying takes the salt and cost from the stored hash, hashes the password again, and compares.
Hashing uses bcryptjs in a Web Worker in your browser.
Examples
- The password
correct horse battery stapleat cost 10 gives a hash such as$2y$10$+ 53 characters. Your hash will differ each time because of the salt. - Cost 10 runs the key setup 1,024 times; cost 12 runs it 4,096 times.
- A hash that starts with
$2y$(PHP) and one with$2b$(Node, Python) are the same algorithm. Changing the prefix is enough to move between them.
Bcrypt prefixes
| Prefix | Where you see it |
|---|---|
$2y$ | PHP password_hash(), Apache htpasswd -B, Laravel |
$2b$ | OpenBSD, Node bcrypt, Python bcrypt, current standard |
$2a$ | Older libraries, Spring Security |
Limitations
- Bcrypt uses only the first 72 bytes of a password. Longer passwords are cut, and the tool warns you when this happens.
- Speed in your browser differs from your server. Measure on the server and pick the highest cost that keeps a login under about 250-500 ms.
- For new systems, Argon2id is the current recommendation. It isn't offered here.
Frequently asked questions
Which bcrypt cost should I use?
Cost 10 is the common default, and 12 is a good choice for most servers today. Pick the highest cost that keeps a login at about a quarter of a second on your server.
Why is the hash different every time?
Each hash gets a new random salt. That's intended: two users with the same password end up with different hashes. Both still verify.
Can a bcrypt hash be decrypted?
No. Bcrypt is one-way. You can only check whether a guessed password produces the same hash, and the cost makes each guess slow.
Related tools
Often used together with Bcrypt Generator.
Htpasswd Generator
Creates .htpasswd lines with bcrypt, APR1-MD5, or SHA-1 hashes for Basic Auth.
Password Generator
Creates strong random passwords with a chosen length and character set.
Password Strength Checker
Estimates how guessable a password is and explains what weakens it.