Bcrypt Hash
CryptoHash and verify passwords with bcrypt using custom salt rounds from 4 to 12. Industry-standard password hashing with an adjustable work factor.
— — click Hash to generate — —About Bcrypt Hash
Bcrypt is a hashing algorithm built specifically for storing passwords. It bakes in a random salt and uses a tunable cost factor to deliberately slow computation, sharply raising the cost of brute-force attacks. This tool runs Bcrypt locally in your browser: it can hash a plaintext password (the output already embeds the algorithm tag, cost, and salt) and verify whether a plaintext matches an existing hash. Passwords never leave your browser, making it handy for seeding test accounts, checking login logic, or troubleshooting password verification after a migration. Tip: Bookmark this tool for quick access whenever you need to generate keys or hashes. All processing happens locally in your browser — no data upload, so it is safe to use with sensitive material.
How to Use
- Open the Bcrypt Hash tool page
- Enter or paste your data into the input area
- View the real-time results and use the copy button to get the output
Use Cases
- Seed test account hashes — When manually inserting a user row in a local database, generate a Bcrypt hash in your app's format.
- Verify login logic — Match a plaintext against a stored hash to confirm your backend compare logic is correct.
- Tune the cost factor — Try different cost values on the target server to balance verification time against security.
- Troubleshoot migrations — Check that legacy hashes still verify correctly under new code after a system migration.
- Audit storage format — Inspect the version prefix (2a/2b) and salt in existing hash strings for correctness.
- Test data seeding — Generate pre-hashed passwords for test database seeds so login tests work without a hashing dependency.
- Cost factor benchmarking — Benchmark different cost factors (10-14) on your target hardware to find the ideal balance of security and response time.
FAQ
Why does the same password produce a different hash each time?
Bcrypt uses a fresh random salt every time, and the salt is encoded into the hash string itself. On verification the algorithm reads the salt back out and recomputes, so a different hash still matches correctly.
What cost factor should I use?
Each +1 to cost doubles the work. Common values are 10-12; tune it on production hardware so a single hash takes about 100-300 ms, blocking brute force without hurting login UX.
Does Bcrypt have a length limit?
Yes. Bcrypt only processes the first 72 bytes of input and ignores the rest. To support very long passwords, a common trick is to pre-hash with SHA-256 before passing to Bcrypt.
Can Bcrypt and SHA-256 be swapped?
Not for storing passwords. SHA-256 is extremely fast, which actually helps attackers crack; Bcrypt is intentionally slow and salted, the right choice for password storage. SHA-256 fits integrity checks instead.
What do the 2a, 2b, 2y prefixes mean?
They are Bcrypt version identifiers that diverged due to historical implementation bugs. Modern libraries default to 2b, the most standard; older prefixes usually still verify fine if the library supports them.
Any browser compatibility requirements?
This tool works in all modern browsers (Chrome, Firefox, Edge, Safari). No plugins or extensions required.
Can I use it offline?
After initial load, most features work offline. The core logic runs entirely in your browser with no network dependency.
Comments
Comments are stored locally in your browser. Configure Giscus for cloud-based comments.