Bcrypt Hash Generator and Verifier

This tool creates bcrypt password hashes and checks whether a password matches an existing hash. Bcrypt is a slow, salted way to store passwords. OWASP suggests a cost factor of at least 10, and 10 to 12 is common for web apps.

The cost factor sets the work per hash: 2 to the power of the cost. Cost 10 means 1,024 rounds of the expensive setup step, and each step up doubles the time. That delay hardly matters for one login, but it adds up fast for an attacker trying millions of guesses. Choose the highest cost your server can handle while logins stay quick. The slider runs from 4 to 16, and anything above 12 can take several seconds in a browser.

Each hash gets a new random salt, so the same password gives a different result every time. The output packs everything into 60 characters: the version ($2b$), the two-digit cost, a 22-character salt and a 31-character hash. To verify, the tool reads the cost and salt back out of the stored hash, hashes your password the same way and reports Match or No match. Hashes that start with $2a$, $2b$ or $2y$ can be checked.

Bcrypt only uses the first 72 bytes of a password and ignores the rest. The tool warns you when you go past that. Hashing runs in your browser with the bcryptjs library, and nothing is sent anywhere. Even so, test with sample passwords rather than live production ones. For fast checksums of files and text, which are not suitable for passwords, see the Hash Generator. To make a strong password to hash, use the Password Generator.