🔒 Runs in your browser — nothing is uploaded✓ Free, no signup
Bcrypt Hash Generator & Checker
Hash a password with bcrypt using the cost factor you choose, or check whether a password matches an existing bcrypt hash. All hashing happens on your device.
Password
10–12 is typical. Each step doubles the time. High values can take several seconds here.
bcrypt hash
The hash will appear here
A new random salt is used every time, so the same password gives a different hash each time — that's expected.
When should you use the Bcrypt Generator?
- Creating a hashed password to seed a database or test account
- Checking a password against a hash from your users table
- Seeing how long different cost factors take
How to use the Bcrypt Generator
- 1
Enter a password
Type the password to hash.
- 2
Choose the cost
10–12 is typical. Each step doubles the work and the time.
- 3
Generate
You'll get a 60-character hash like $2b$10$… with a fresh random salt.
- 4
Or verify
Switch to Verify, paste a password and a hash, and see whether they match.
Examples
Hash format
Password (cost 10)
correct horse battery staple
bcrypt hash
$2b$10$ + 22-character salt + 31-character hash (60 characters in total, different every time)
Common errors and how to fix them
The hash is different every time- That's expected — a new random salt is used each time. Verify still works because the salt is stored inside the hash.
Long passwords match when they shouldn't- bcrypt only uses the first 72 bytes of a password. Anything after that is ignored.
More from Encoding & Security
Free tools that run in your browser — no signup, nothing uploaded.
JWT Decoder
Decode and inspect JSON Web Tokens (JWT) Header and Payload.
JWT Generator
Create and sign HS256/HS384/HS512 JSON Web Tokens for testing.
Hash Generator (MD5, SHA)
Generate MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes.
Password Generator
Generate strong, random passwords with the length and characters you choose.
Base64 Encoder ⇆ Decoder
Encode text to Base64 and decode Base64 to text for API debugging.
URL Encoder & Decoder
Cleanly encode special characters in URLs and decode query strings.
String Escape & Unescape
Escape or unescape strings for JavaScript, Java, C#, HTML, XML, SQL, CSV and regex.
HTML Entity Encoder & Decoder
Encode special characters as HTML entities, or decode entities back to text.
Number Base Converter
Convert numbers between binary, octal, decimal, hex and any base up to 36.
Bcrypt Generator FAQ
No. bcrypt is a one-way hash. You can only check whether a password matches by hashing it again with the same salt — which is what Verify does.
Choose the highest value that keeps login fast on your server — usually 10 to 12. OWASP recommends at least 10.
They're bcrypt version prefixes. $2b$ is current; $2a$ and $2y$ (PHP) are older names for compatible variants, and this tool verifies all of them.
Slowness makes guessing passwords expensive. Each cost step doubles the work an attacker needs per guess.
Hashing happens in your browser and nothing is sent anywhere. Even so, prefer test passwords when you can.
No. Everything runs in your browser, so your password never leaves your device.