Hash a password with bcrypt at cost 4 to 14, or check a password against a hash
Runs in your browser. Nothing you type is sent anywhere. Updated on 24 Oct 2026.Bcrypt is deliberately slow, which is what makes a stolen password database hard to crack. The cost setting doubles the work at each step, from 4 to 14 here. Hash a password, or check one against an existing hash. Everything runs locally, so no password is transmitted.
On the Hash tab, type the password into Password or text and set the Cost factor; 10 to 12 is typical.
Press Hash and copy the new $2b$ hash with its Copy button.
To check a password later, open the Verify tab and paste the hash into the bcrypt hash box.
Type the password and press Verify; the result reads Match or No match.
This bcrypt hash generator turns a password into a salted bcrypt hash at a cost from 4 to 14, and checks whether a password matches an existing hash. Each hash is split into its parts, the version, cost, 22-character salt and 31-character hash, so you can see what the string actually stores, along with the time the work took.
Developers use it to create a known admin password for seed data or a test fixture, to confirm that a hash in a database really belongs to the password a user says they set, and to choose a cost factor by seeing how long each step takes on ordinary hardware. It also reads hashes from PHP ($2y$) and older libraries ($2a$).
Hashing runs in a Web Worker, a background thread in your browser, using the bcryptjs library, so the page stays responsive even at cost 14. Nothing is uploaded. Passwords and hashes are never logged or stored; only the cost you picked is remembered. Timings here are close to what a Node.js server using bcryptjs would see, while native bcrypt libraries are two to three times faster.
Every step of cost doubles the work. Cost 10 takes around a tenth to a fifth of a second on a laptop; cost 14 is sixteen times slower, which is noticeable on every login your server handles. Most systems use 10 to 12. bcrypt reads only the first 72 bytes of a password, and the tool warns when yours is longer.
Related tools: Password Strength Checker, Password Generator, HMAC Generator.
Open the Verify tab, paste the full 60-character hash starting with $2a$, $2b$ or $2y$, type the password and press Verify. The tool hashes the password again with the salt and cost stored in the hash and compares the result. You will see Match or No match, plus the time it took.
No. bcrypt is a one-way function, not encryption, so there is no key that turns the hash back into the password. The only way to find the password is to guess candidates and hash each one, which the cost factor makes deliberately slow. This tool can check a guess, not reverse a hash.
Every hash gets a new random 16-byte salt, stored as the 22 characters after the cost. Different salts give different hashes, which stops attackers from cracking many users at once with precomputed tables. Every one of those hashes still verifies against the password, because the salt travels inside the hash.
Pick the highest cost your login server can afford, usually 10 to 12. Each step doubles the time, so cost 12 is four times slower than 10. Aim for roughly a quarter of a second per hash on your production hardware, and raise the cost every few years as machines get faster.
Those three prefixes are version markers. $2a$ is the original fixed format, $2b$ is the current one that corrects a length bug in OpenBSD, and $2y$ is what PHP calls the corrected crypt_blowfish output. All three are the same algorithm for normal passwords and verify here. $2x$ marks hashes from a buggy old library and should be replaced.
No. Hashing and verifying run in a background thread in your browser with the bcryptjs library. The password and hash are not sent anywhere, not logged and not saved; only the cost factor you chose is remembered on this device. Closing the tab clears everything you typed.
Still stuck? Ask about Bcrypt Hash and Verify and anybody who knows can answer. No account needed.
Same job, other tools: Passphrase Generator – Three to ten random words you can actually remember · Webhook Signature Verifier – Check that a webhook body matches the signature header its sender attached · OTP Generator – Time-based one-time passwords with 6 or 8 digits and a choice of algorithm.
On the related tools: JWT Decoder – Paste a token to read its header, payload and expiry.
In the collection Security Tools for Developers.