Bcrypt Hash
CryptoHash and verify passwords with bcrypt using custom salt rounds from 4 to 12. Industry-standard password hashing with an adjustable work factor. Cost adjustable.
— — click Hash to generate — —Related Tools
About Bcrypt Hash
Bcrypt is a hashing algorithm built specifically for storing passwords. It bakes in a random salt and uses a tunable cost factor to deliberately slow computation, sharply raising the cost of brute-force attacks. This tool runs Bcrypt locally in your browser: it can hash a plaintext password (the output already embeds the algorithm tag, cost, and salt) and verify whether a plaintext matches an existing hash. Passwords never leave your browser, making it handy for seeding test accounts, checking login logic, or troubleshooting password verification after a migration. For example, hashing mypassword with cost factor 10 yields a $2b$10$ 60-character bcrypt string with a fresh salt each time.
How to Use
- Open the Bcrypt Hash tool
- Enter the content and set the parameters
- Adjust the output options as needed
- Click the Generate button; results appear in real time
- Copy or export the result
Use Cases
- Seed test account hashes — When manually inserting a user row in a local database, generate a Bcrypt hash in your app's format.
- Verify login logic — Match a plaintext against a stored hash to confirm your backend compare logic is correct.
- Tune the cost factor — Try different cost values on the target server to balance verification time against security.
- Troubleshoot migrations — Check that legacy hashes still verify correctly under new code after a system migration.
- Audit storage format — Inspect the version prefix (2a/2b) and salt in existing hash strings for correctness.
- Test data seeding — Generate pre-hashed passwords for test database seeds so login tests work without a hashing dependency.
- Cost factor benchmarking — Benchmark different cost factors (10-14) on your target hardware to find the ideal balance of security and response time.
FAQ
Why does the same password produce a different hash each time?
Bcrypt uses a fresh random salt every time, and the salt is encoded into the hash string itself. On verification the algorithm reads the salt back out and recomputes, so a different hash still matches correctly.
What cost factor should I use?
Each +1 to cost doubles the work. Common values are 10-12; tune it on production hardware so a single hash takes about 100-300 ms, blocking brute force without hurting login UX.
Does Bcrypt have a length limit?
Yes. Bcrypt only processes the first 72 bytes of input and ignores the rest. To support very long passwords, a common trick is to pre-hash with SHA-256 before passing to Bcrypt.
Can Bcrypt and SHA-256 be swapped?
Not for storing passwords. SHA-256 is extremely fast, which actually helps attackers crack; Bcrypt is intentionally slow and salted, the right choice for password storage. SHA-256 fits integrity checks instead.
What do the 2a, 2b, 2y prefixes mean?
They are Bcrypt version identifiers that diverged due to historical implementation bugs. Modern libraries default to 2b, the most standard; older prefixes usually still verify fine if the library supports them.