Generate a bcrypt hash for a test user or a config file
Runs in your browser. Nothing you type is sent anywhere. Updated on 24 Oct 2026.Need a bcrypt hash to seed an admin user, fill a test fixture or paste into an htpasswd or Docker registry config? Type the password, choose the cost (10 is the common default), and copy a fresh $2b$ hash. Every hash gets its own random salt, so running it twice gives two different strings that both verify. The work runs in a background thread on your device.
The page opens on the Hash tab, ready to make a new salted hash.
Type the password for your test user or config file into Password or text.
Move the Cost factor slider; the label shows about how long one hash takes.
Press Hash, or Ctrl+Enter, and wait while the background thread works.
Press Copy next to the hash and paste it into your seed script or config file.
This bcrypt hash generator turns a password into a salted bcrypt hash at a cost from 4 to 14, and checks whether a password matches an existing hash. Each hash is split into its parts, the version, cost, 22-character salt and 31-character hash, so you can see what the string actually stores, along with the time the work took.
Developers use it to create a known admin password for seed data or a test fixture, to confirm that a hash in a database really belongs to the password a user says they set, and to choose a cost factor by seeing how long each step takes on ordinary hardware. It also reads hashes from PHP ($2y$) and older libraries ($2a$).
Hashing runs in a Web Worker, a background thread in your browser, using the bcryptjs library, so the page stays responsive even at cost 14. Nothing is uploaded. Passwords and hashes are never logged or stored; only the cost you picked is remembered. Timings here are close to what a Node.js server using bcryptjs would see, while native bcrypt libraries are two to three times faster.
The rest of the article, and all 6 questions about Bcrypt Hash and Verify, are on the Bcrypt Hash and Verify page.
Open the Verify tab, paste the full 60-character hash starting with $2a$, $2b$ or $2y$, type the password and press Verify. The tool hashes the password again with the salt and cost stored in the hash and compares the result. You will see Match or No match, plus the time it took.
No. bcrypt is a one-way function, not encryption, so there is no key that turns the hash back into the password. The only way to find the password is to guess candidates and hash each one, which the cost factor makes deliberately slow. This tool can check a guess, not reverse a hash.
Every hash gets a new random 16-byte salt, stored as the 22 characters after the cost. Different salts give different hashes, which stops attackers from cracking many users at once with precomputed tables. Every one of those hashes still verifies against the password, because the salt travels inside the hash.
No. Hashing and verifying run in a background thread in your browser with the bcryptjs library. The password and hash are not sent anywhere, not logged and not saved; only the cost factor you chose is remembered on this device. Closing the tab clears everything you typed.
Still stuck? Ask about Bcrypt Hash and Verify and anybody who knows can answer. No account needed.
Same job, other tools: Passphrase Generator – Three to ten random words you can actually remember · HMAC-SHA256 Generator – Compute an HMAC-SHA256 signature in hex and Base64 · OTP Generator – Time-based one-time passwords with 6 or 8 digits and a choice of algorithm.
On the related tools: JWT Decoder – Paste a token to read its header, payload and expiry.
In the collection Security Tools for Developers.