Bcrypt Hash Generator - Free Online Password Hashing Tool

Using This Secure Password Hashing Tool

Type your plaintext password into the input field.
Choose a cost factor (work factor) - 10 to 12 is the current recommendation.
Click Hash to generate a new bcrypt hash with a random salt.
Use the Verify section: enter the plaintext and an existing hash to confirm they match.

Bcrypt Hash Generator is a password-hashing function designed to be intentionally slow - its cost factor increases the computation time exponentially, making brute-force attacks expensive even with modern GPUs. This bcrypt verifier ensures you can check passwords without storing them in plain text. Never store plain passwords or use fast hashes like MD5 or SHA-256 for password storage; instead, use this secure password hashing tool. All hashing runs locally in this browser - no passwords are ever transmitted.

Understanding the Bcrypt Work Factor

The cost factor (also called work factor or rounds) is the base-2 logarithm of the number of iterations. Cost 10 means 2¹⁰ = 1,024 iterations; cost 12 means 2¹² = 4,096. Doubling the work factor doubles the time to hash a password - and doubles the time for an attacker to crack each guess. OWASP currently recommends cost 10–12 on most hardware, targeting around 1 second per hash on your production server using a robust bcrypt salt generator.

Includes a random 128-bit salt automatically - each hash is unique even for identical passwords
Cost factors 4–31 supported; 10–12 recommended for production
Verify mode checks a plaintext against an existing salted password hash without revealing the salt
Uses bcryptjs - a pure JavaScript implementation, no native modules or server calls

Frequently Asked Questions

Why is the same password hashed differently each time?

Bcrypt generates a new random 128-bit salt for every hash. The salt is embedded in the output string, so verification knows which salt to use. Two hashes of the same password are always different - this defeats rainbow table attacks.

What does a bcrypt hash look like?

A bcrypt hash looks like $2b$12$xyz.... $2b$ is the version identifier, 12 is the cost factor, the next 22 characters are the salt, and the remaining 31 characters are the hash.

What is the maximum password length for bcrypt?

Bcrypt processes only the first 72 bytes of the password. Passwords longer than 72 bytes are silently truncated. If you need to support very long passwords, pre-hash with SHA-256 before bcrypt (carefully, as this has trade-offs).

Is bcrypt still recommended, or should I use Argon2?

Both are good choices. Argon2 (the PHC winner in 2015) allows tuning memory usage in addition to time, making it more resistant to GPU attacks. For most web applications, bcrypt at cost 12 remains a solid and widely supported choice.

Whether you're developing a new app or auditing an old one, our web security tools are here to help. Check out the Bcrypt & Scrypt tool for more options, use our All Hashes generator for general needs, and bookmark this Bcrypt Hash Generator for future use.

Bcrypt Hash Generator online

Generate bcrypt hashes and verify passwords - browser-side