Bcrypt generator & checker
Hash a password with bcrypt at the cost factor you choose, or check whether a password matches an existing bcrypt hash. It all runs in your browser.
Generate a hash
Check a password
What the cost factor really costs
bcrypt’s cost is an exponent: the key setup runs 2cost times. Measure it on this device and watch each step double. Your server will be faster or slower, but the doubling is the same.
That doubling hits attackers too. If a login takes 100 ms at your chosen cost, an attacker’s GPU is still limited to thousands of guesses a second per card, instead of the billions possible against MD5 or SHA-256.
Using bcrypt correctly
- Pick the cost by timing, not by habit. Aim for 100–250 ms per hash on production hardware, and raise it as hardware gets faster.
- Rehash on login when you raise the cost: after a successful check, hash the password again at the new cost and store it.
- Mind the 72-byte limit. Either cap password length at 72 bytes or pre-hash with HMAC-SHA-256 and a server-side key, then Base64 the result before bcrypt.
- Compare with the library. Always use
bcrypt.compare(or your language’s equivalent), never a string comparison of freshly computed hashes.
This page uses bcryptjs, a pure-JavaScript implementation compatible with the C bcrypt used by most frameworks. Hashes it makes verify in PHP’s password_verify, Python’s bcrypt, Node’s bcrypt and Spring Security.
Need a fast checksum rather than a password hash? Use the hash generator.
Questions people ask
What is bcrypt?
bcrypt is a password hashing function designed by Niels Provos and David Mazières in 1999, based on the Blowfish cipher. It is deliberately slow and includes a random salt, so attackers who steal a database cannot test guesses quickly or use precomputed tables.
What cost factor should I use?
Choose the highest cost that keeps a login under roughly 250 milliseconds on your server. OWASP’s Password Storage Cheat Sheet recommends a work factor of 10 or more. Each +1 doubles the time, so 12 takes four times as long as 10. The cost timer on this page measures it in your browser.
What does a bcrypt hash look like?
A bcrypt hash such as $2b$12$R9h/cIPz0gi.URNNX3kh2OPST9/PgBkqquzi.Ss7KIUgO2t0jWMUW has four parts: the version ($2b$), the cost (12), a 22-character salt, and the 31-character hash, all in bcrypt’s own Base64 alphabet. Everything needed to verify the password is in the string.
Why does the same password give a different hash each time?
Because bcrypt generates a new random salt for every hash. To check a password, the verifier reads the salt and cost from the stored hash, re-hashes the candidate password with them and compares the results. Use the checker on this page to do exactly that.
Does bcrypt have a length limit?
Yes. bcrypt uses only the first 72 bytes of the password; anything after that is ignored. Characters outside ASCII take 2 to 4 bytes each in UTF-8. The tool warns you when input goes past 72 bytes.
Should I use bcrypt or Argon2?
OWASP currently recommends Argon2id first, then scrypt, with bcrypt as a sound choice for systems that already use it or where Argon2 is unavailable. All three are far better than SHA-256 or MD5 for passwords.