About this bcrypt tool
bcrypt is a password hashing function built to be slow on purpose, so that guessing passwords is expensive even for someone who steals a database of hashes. Each hash contains its own random salt and a cost factor, which sets how many rounds of work are done. Use Generate hash to create the 60-character string that websites store, hash several passwords at once, or pick the prefix your framework expects. Use Verify hash to see whether a password produces an existing hash. Hashing runs in your browser, so the password is never sent anywhere.
How to generate or check a bcrypt hash
- Pick what to do. Choose Generate hash to create hashes, or Verify hash to compare a password with an existing hash.
- Enter the password. Type the password, or press an example. For a batch, put one password on each line, up to 20.
- Set the options. When generating, drag Cost factor and choose a Hash prefix. When verifying, paste the hash into Existing bcrypt hash.
- Press the button. Generate bcrypt hash shows the new hash and its parts; Verify bcrypt hash shows MATCH or NO MATCH. Press Copy hash to copy the result.
Frequently asked questions
What does the cost factor do?
The hash does 2 to the power of the cost rounds of work, so each step up doubles the time it takes. Pick the highest cost that keeps your login fast enough; 10 to 12 is typical today, and you can raise it over time.
Why is the hash different every time for the same password?
bcrypt mixes a fresh random salt into every hash. The salt is stored inside the hash string, which is how Verify hash can recompute and compare. Two different hashes of one password can both be valid.
What are the parts of a bcrypt hash?
A 60-character hash has the prefix such as $2b$, a two-digit cost like 12, a 22-character salt, and a 31-character digest, with dollar signs between the first three. The Anatomy section after generating shows each part.
Which hash prefix should I choose?
Use $2b$ unless your library needs another. PHP and Laravel write $2y$, and many older libraries write $2a$. For ordinary passwords all of them give hashes that each library verifies; $2x$ exists only for hashes made with an old PHP bug.
Is there a limit on password length?
Yes. bcrypt reads only the first 72 bytes, and characters outside basic English can take two to four bytes each. The tool warns you when text is cut off. To support longer passphrases, hash them with SHA-256 first.
Why is batch hashing limited to cost 12?
Each hash takes noticeable time in a browser, and 20 passwords at a high cost would freeze the page for a long while. Batches therefore run at cost 12 or below; hash one password at a time for 13 to 15.