Bcrypt Hash Generator
Bcrypt is a password-hashing function designed by Niels Provos and David Mazières, based on the Blowfish cipher. It is widely used for secure password storage in many systems and frameworks like Laravel, PHP, Ruby on Rails, and Node.js.
Generate Bcrypt Hash
What is the Cost Factor?
The cost factor determines how computationally expensive the hash generation is. Each increment doubles the required computation time. This makes brute-force attacks more difficult.
Verify Bcrypt Hash
Bcrypt Hash Information
Bcrypt hashes include:
- Algorithm identifier: <code>$2a$</code>, <code>$2b$</code>, or <code>$2y$</code>
- Cost factor: two digits representing rounds (e.g., <code>10</code>)
- Salt: 22 characters
- Hash: 31 characters
Security Information
Important notes about Bcrypt:
- Bcrypt automatically generates and incorporates a random salt for each password.
- The same password will generate different hashes each time due to the salt.
- Bcrypt is intentionally designed to be slow to resist brute force attacks.
- Cost factor (rounds) should be increased over time as computing power increases.
- This tool processes all data in your browser - no passwords are sent to our server.
About Bcrypt Hash Generator
Generate secure Bcrypt hashes with custom cost factors and verify existing hashes against plaintext passwords
Generate salted bcrypt hashes and verify whether a candidate password matches an existing bcrypt string.
Key features
- Security task Generate salted bcrypt hashes and verify whether a candidate password matches an existing bcrypt string.
- Required material Enter a password to hash, or provide both a bcrypt hash and candidate password in the verification panel.
- Parameters that must match Choose the cost factor; each increment roughly doubles the computation and should be benchmarked on the deployment hardware.
- Result and verification The generated modular crypt string includes algorithm version, cost, salt, and hash; verification returns only match or no match.
How to use Bcrypt Hash Generator
Follow this workflow to work with bcrypt password hashes safely and accurately.
- Provide the required material Enter a password to hash, or provide both a bcrypt hash and candidate password in the verification panel.
- Match security parameters Choose the cost factor; each increment roughly doubles the computation and should be benchmarked on the deployment hardware.
- Run the operation Run the operation locally, keep sensitive bcrypt password hashes out of logs and screenshots, and never assume a successful transformation proves secure deployment.
- Verify before use The generated modular crypt string includes algorithm version, cost, salt, and hash; verification returns only match or no match.
Usage tips
- Use a unique automatically generated salt for every stored password.
- Select the highest cost your login infrastructure can handle without unacceptable latency or denial-of-service risk.
- Rehash successfully authenticated passwords when the stored cost is below the current policy.