Generate real bcrypt password hashes with an adjustable cost factor, or verify a password against an existing hash — 100% client-side, nothing leaves your browser. Free, no signup.

Home › Security & Privacy Tools › Bcrypt Hash Generator

Bcrypt Hash Generator

Create secure bcrypt password hashes and verify passwords against existing hashes — right in your browser. Real bcrypt, adjustable cost factor, free forever.

Password

Cost factor 10

Cost 10 is the recommended default — strong protection in well under a second. Higher costs are slower but harder to crack.

Hashing…

Your bcrypt hash (took –)

Every hash uses a fresh random salt, so the same password produces a different hash each time — that is expected and correct. Hashing runs in small chunks so the page stays responsive, with a progress bar at higher cost factors.

Password to check

Bcrypt hash

Verifying…

100% private

Hashing and verification happen entirely in your browser. Your passwords are never sent anywhere.

No signup

Use every feature instantly — no account, no email, no tracking.

Free forever

Unlimited hashes and verifications, with no watermarks or limits.

How to use

1Enter a password
Type the password you want to hash in the Generate tab. Use the Show button to double-check it.
2Pick a cost factor
Drag the slider (4–14). Cost 10 is the safe default; higher costs resist cracking longer but take more time.
3Generate and copy
Hit Generate Bcrypt Hash, watch the progress bar, then copy the resulting $2b$ hash into your app or database.
4Verify anytime
Switch to the Verify tab, paste any bcrypt hash, enter the password, and get an instant match / no-match answer.

Features

Real bcrypt, verified correct

A genuine Blowfish-based bcrypt implementation, byte-for-byte verified against reference test vectors — not a lookalike.

Adjustable cost factor

Set the work factor from 4 (fast) to 14 (very strong) with a live slider and per-run timing.

Built-in verify mode

Check any password against any $2a$, $2b$ or $2y$ bcrypt hash with a clear match / no-match verdict.

Cryptographically random salts

Every hash gets a fresh 128-bit salt from your browser's secure random generator.

Stays responsive

Hashing runs in small chunks with a live progress bar, so the page never freezes — even at cost 14.

Fully offline

No servers, no uploads, no logs. The code runs 100% on your device and works without an internet connection.

Frequently asked questions

What is bcrypt?

Bcrypt is a password-hashing algorithm designed to be deliberately slow and resistant to brute-force attacks. It is the industry standard for storing passwords — used by frameworks like Django, Laravel, Ruby on Rails and Node.js apps — because its adjustable cost factor keeps hashes strong as hardware gets faster.

Why bcrypt instead of MD5 or SHA-256?

MD5 and SHA-256 are built for speed, which is exactly what password crackers want — billions of guesses per second on a GPU. Bcrypt is intentionally slow and memory-hard, turning that same attack into years of work. Never store passwords with plain MD5 or SHA-256.

What cost factor should I choose?

Cost 10 (1,024 rounds) is the widely recommended default and takes well under a second here. Cost 12 is a solid choice for high-security apps. Costs below 10 are fine for testing but weak for production; cost 14 is very strong but takes several seconds per hash.

Why does the same password give a different hash every time?

Each hash includes a fresh random 128-bit salt, so identical passwords produce different hashes. That is a security feature: it stops attackers from precomputing rainbow tables. Verification still works because the salt is stored inside the hash string itself.

Is my password sent to a server?

No. Everything runs locally in your browser with JavaScript — your password never leaves your device, is never logged, and the tool works fully offline.

How do I verify a bcrypt hash in my own code?

Use your language's bcrypt library: Python's bcrypt.checkpw(), Node's bcrypt.compare(), PHP's password_verify(), or Ruby's BCrypt::Password.new(hash) == password. Paste a hash from this tool into the Verify tab first to confirm it behaves as expected.

Related tools

Password Generator

Create strong, random passwords instantly.

SHA-256 Hash Generator

Compute SHA-256 checksums for any text.

Password Strength Checker

Test how crack-resistant your password is.

AES Text Encrypt & Decrypt

Encrypt text with AES-256 in your browser.