Bcrypt Hash Generator & Checker
Generate bcrypt password hashes or verify a password against an existing hash. 100% client-side.
🔒 100% private: All hashing happens in your browser using the bcryptjs library. Your password is never transmitted. As best practice, avoid using real production passwords in any online tool.
4 (fast, testing)12 (recommended)15 (slow, secure)
2^12 = 4,096 rounds
⚡ Cost factor reference
| Cost | Rounds | Approx time | Recommendation |
|---|---|---|---|
| 4 | 2⁴ = 16 | <1 ms | Testing only |
| 8 | 2⁸ = 256 | ~4 ms | Too fast for production |
| 10 | 2¹⁰ = 1,024 | ~60 ms | Common baseline |
| 12 | 2¹² = 4,096 | ~250 ms | ✅ Recommended default |
| 14 | 2¹⁴ = 16,384 | ~1 s | High security |
| 15 | 2¹⁵ = 32,768 | ~2 s | Slow — DoS risk |
Times are approximate for modern hardware. Tune so hashing takes 100–250 ms on your production server.
🔒 100% private: All hashing uses the bcryptjs library in your browser. Based on bcrypt (Provos & Mazières, 1999). Supports $2a$, $2b$, and $2y$ variants.
About Bcrypt Hash Checker
Bcrypt is a password-hashing function designed by Niels Provos and David Mazières (1999), based on the Blowfish cipher. Unlike fast hashes (MD5, SHA-256), bcrypt is intentionally slow and tunable — the "cost factor" doubles the work with each increment. This makes brute-force attacks impractical. Bcrypt also includes a per-password salt to prevent rainbow table attacks. This tool generates bcrypt hashes with adjustable cost (4–15) and verifies passwords against existing bcrypt hashes.
How It Works
- Generate mode: enter a password, choose a cost factor, click Generate.
- Verify mode: enter a password and a bcrypt hash — see if they match.
- Copy the generated hash for use in your application.
- Adjust the cost factor to see how it affects hashing time.
✨ Key Features
- ✓Generate bcrypt hashes (2a, 2b variants)
- ✓Verify a password against an existing bcrypt hash
- ✓Adjustable cost factor (4–15)
- ✓Real-time hashing with progress indicator
- ✓Shows hash timing (ms) for the selected cost
- ✓Breaks down hash structure (algorithm, cost, salt, hash)
- ✓Explains why cost matters (with timings reference)
- ✓Copy password, hash, or verification result
- ✓100% client-side — your password never leaves your browser
🎯 Common Use Cases
- →Debugging bcrypt password verification in your app
- →Generating test hashes for authentication testing
- →Comparing cost factors to pick the right one for production
- →Verifying that a stored hash matches a known password
- →Understanding bcrypt hash format and structure
- →Learning why bcrypt is preferred over MD5/SHA for passwords
- →Preparing hashed test users for integration tests
- →Auditing a database of bcrypt hashes
💡 Advanced Tips & Pro Insights
- ▸Bcrypt hash format: $2a$12$<22 chars salt><31 chars hash>. $2a$ = algorithm version, 12 = cost factor (2^12 = 4096 rounds), then 53 chars base64-encoded salt+hash.
- ▸Cost factor guidance (2026): 10 is a common baseline, 12 is recommended for most apps, 14+ for high-security. Higher cost = slower login for users but slower attacks too.
- ▸Bcrypt has a maximum password length of 72 bytes. Longer passwords are silently truncated.
- ▸Never use MD5 or SHA-256 for passwords — they are too fast. Always use bcrypt, scrypt, or Argon2id.
- ▸Use $2b$ (not $2a$) when possible — $2b$ fixes a subtle bug that only affected passwords >255 characters.
- ▸Hash timing should be tuned to ~100–250ms on your production hardware.
Frequently Asked Questions
Is this bcrypt checker free?▾
Yes, this bcrypt hash checker is completely free with no signup, email, or usage limits.
Is my password safe?▾
Yes, 100% safe. All hashing and verification happens in your browser using the bcryptjs library. Your password is never transmitted.
What is bcrypt?▾
Bcrypt is a password-hashing function based on the Blowfish cipher, designed to be intentionally slow. It uses a tunable cost factor, so you can make hashing as slow as needed to resist brute-force attacks.
What is the cost factor?▾
The cost factor (work factor or rounds) is a number (4–31) that controls how slow bcrypt is. Each increment doubles the work: cost 10 = 2^10 = 1024 rounds, cost 12 = 2^12 = 4096 rounds.
What cost factor should I use?▾
For most apps, cost 12 (~250ms) is a good balance. Use 10 for development, 12 for production, and 14+ for high-security applications.
Why is bcrypt better than MD5 or SHA-256?▾
MD5 and SHA-256 are designed to be FAST — billions of hashes per second on GPUs. Bcrypt is designed to be SLOW and TUNED, so brute-forcing passwords is impractical.
Can I use bcrypt for longer passwords?▾
Bcrypt silently truncates passwords longer than 72 bytes. For longer passwords, pre-hash with SHA-256 (then base64-encode to avoid null bytes), or use Argon2id.
What is the difference between $2a$, $2b$, $2y$?▾
$2a$ is the original algorithm. $2b$ fixes a bug in $2a$ for passwords >255 chars. $2y$ is a PHP-specific variant. All modern libraries use $2b$.