Bcrypt Generator & Checker
Create a bcrypt hash at the cost factor you choose, or check whether a password matches an existing hash, with the hash's version, cost and salt explained. Nothing leaves your browser.
Bcrypt Generator & Checker
Hashing runs in your browser with bcrypt.js. Passwords and hashes never leave this page and aren't saved in share links.
Runs in your browser. Passwords aren't sent, stored or put in share links.
Scratchpad auto-saved
How it works — in four simple steps
No signup and nothing to install — it all runs in your browser.
Type a password
Or paste a test value.
Choose the cost
10–12 is typical; each step doubles the time.
Hash it
Copy the result into your app or database.
Check later
Paste a password and hash to see if they match.
Pick the cost that takes about 250 ms–1 s on your server, and raise it as hardware gets faster.
Features
Any cost factor
4 to 15, with live timing so you can choose a sensible cost.
$2a$, $2b$ or $2y$
The prefix your language or framework expects.
Check a hash
Verify a password against any bcrypt hash.
Hash anatomy
Version, cost, salt and hash parts highlighted and explained.
72-byte warning
Flags passwords longer than bcrypt can use.
Private
Runs in your browser; passwords aren't stored or shared.
About the Bcrypt Generator & Checker
bcrypt is a password-hashing function designed in 1999 to be deliberately slow. Its cost factor sets how many rounds of the expensive Blowfish key setup run: cost 12 means 212 = 4,096 rounds, and each step up doubles the time. Because every hash includes a random 128-bit salt, hashing the same password twice gives different results, and attackers can't use precomputed tables. A bcrypt hash such as $2b$12$… holds everything needed to check it: version, cost, the 22-character salt and the 31-character hash.
To check a password, bcrypt reads the cost and salt from the stored hash, hashes the password again the same way and compares. That's what Check does here. The prefixes $2a$, $2b$ and $2y$ are interchangeable for normal passwords: $2b$ is the current OpenBSD standard, and $2y$ is PHP's name for the same thing. One limit to know: bcrypt uses only the first 72 bytes of a password, and the tool warns when yours is longer.
Pick a cost that takes roughly a quarter to one second on your production server. That's commonly 10–12 today, and you should raise it as hardware gets faster. For new systems, OWASP's guidance prefers Argon2id, with bcrypt as a solid alternative. Hashing here uses the open-source bcrypt.js library, served from this site, and the passwords you type aren't sent anywhere or saved in share links.