Bcrypt Hash Generator
Hash passwords with bcrypt online for free using our bcrypt hash generator. Configure the cost factor (4-16 rounds), generate a secure $2b$ hash with a unique random salt, and verify plain-text passwords against existing bcrypt hashes - all processed locally in your browser with no signup required.
Hash passwords with bcrypt using a configurable cost factor, or verify a plain-text password against an existing bcrypt hash. All processing happens locally in your browser - no data is sent to any server.
Max 72 bytes (UTF-8). Longer passwords are truncated.
Higher = slower but more secure. 10 is the standard default.
- bcrypt automatically generates a unique salt for every hash - never reuse hashes
- Passwords longer than 72 bytes are silently truncated by the bcrypt algorithm
- Use cost factor 10-12 for production; higher values significantly increase login time
- All computation runs locally in your browser - no passwords are transmitted
Why Use Our Bcrypt Hash Generator?
Instant bcrypt Hash Generation
Generate bcrypt hashes instantly in your browser with no server round-trips. Our bcrypt hash generator produces results in milliseconds at cost 10 - the industry-standard default for password hashing.
Secure bcrypt Hash Generator Online
All bcrypt hashing and verification runs locally in your browser. Your passwords never leave your device, ensuring 100% privacy every time you use our bcrypt hash generator online.
bcrypt Hash Generator Online - No Installation
Use our bcrypt hash generator directly in any browser with no downloads, plugins, or software required. Hash and verify passwords from any device, anywhere, completely free.
Configurable Cost Factor (4-16 Rounds)
Adjust the bcrypt cost factor from 4 (testing) to 16 (maximum practical security). Each increment doubles the computation time, letting you balance security and performance for your use case.
Common Use Cases for Bcrypt Hash Generator
User Authentication Systems
Hash user passwords with bcrypt before storing them in your database. Our bcrypt hash generator lets you test and validate your hashing implementation without writing any code.
API & Backend Development
Developers use our bcrypt hash generator to quickly produce test hashes for seeding databases, writing unit tests, and verifying that authentication logic handles bcrypt correctly.
Password Migration & Auditing
Security engineers use the bcrypt hash generator to audit legacy password storage systems. Generate bcrypt hashes to compare against MD5 or SHA-1 hashes and plan migration to modern storage.
Security Training & Education
Educators and security trainers use our bcrypt hash generator to demonstrate adaptive hashing, cost factors, and why bcrypt is preferred over fast hash functions for password storage.
Hash Verification & Debugging
Use the verify mode to confirm that a plain-text password matches a stored bcrypt hash. This is useful for debugging authentication issues without needing a running application.
Penetration Testing & CTF Challenges
Security researchers and CTF participants use our bcrypt hash generator to generate and verify hashes during password cracking exercises, hash identification challenges, and security assessments.
Understanding bcrypt Password Hashing
What is bcrypt?
bcrypt is an adaptive password hashing function designed by Niels Provos and David Mazières in 1999, based on the Blowfish cipher. Unlike fast hash functions such as MD5 or SHA-256, bcrypt is intentionally slow - its cost factor controls how many iterations the algorithm performs, making brute-force attacks exponentially more expensive as hardware improves. Our bcrypt hash generator implements the full $2b$ specification entirely in your browser, including the EksBlowfishSetup key schedule, a unique random salt per hash, and the standard 60-character output format. All processing is local - your passwords never leave your device.
How Our bcrypt Hash Generator Works
- 1. Enter Your Password and Choose a Cost Factor: Type the password you want to hash and select a cost factor (4-16). Cost 10 is the recommended default for production systems. Higher values increase security but also increase hashing time.
- 2. Instant Browser-Based bcrypt Hashing: Click Generate bcrypt Hash and the tool runs the full bcrypt algorithm locally in your browser. A unique random salt is generated for every hash - no two hashes of the same password are identical.
- 3. Copy the Hash or Verify a Password: Copy the 60-character bcrypt hash string for use in your application. Switch to Verify mode to confirm that a plain-text password matches any existing bcrypt hash.
Anatomy of a bcrypt Hash
- Version Prefix ($2b$): The $2b$ prefix identifies this as a bcrypt hash using the corrected 2b variant, which fixes a Unicode handling bug present in the older $2a$ version. Always use $2b$ for new implementations.
- Cost Factor (NN): The two-digit number after the version prefix is the cost factor (e.g., $2b$10$). It represents the base-2 logarithm of the number of iterations: cost 10 = 1,024 iterations, cost 12 = 4,096 iterations.
- Salt (22 characters): The first 22 characters of the 53-character data block are the base-64 encoded 16-byte random salt. The salt is unique per hash, preventing rainbow table attacks and ensuring identical passwords produce different hashes.
- Hash Output (31 characters): The remaining 31 characters are the base-64 encoded 23-byte bcrypt output. The full 60-character string (version + cost + salt + hash) is self-contained - everything needed for verification is embedded in the hash.
Important Limitations
bcrypt truncates passwords at 72 bytes (not characters) after UTF-8 encoding. Passwords longer than 72 bytes produce the same hash as their first 72 bytes - a known limitation of the algorithm. For passwords that may exceed this limit, consider pre-hashing with SHA-256 before bcrypt. Additionally, our bcrypt hash generator is a development and testing tool - for production use, always implement bcrypt through a well-audited library in your server-side language (e.g., bcrypt.js for Node.js, passlib for Python, or spring-security-crypto for Java).
Related Tools
RSA/ECDSA Key Generator
Generate cryptographically secure RSA and ECDSA public/private key pairs using the Web Crypto API - Free online key generator
Cryptographically Secure Password Generator
Generate high-entropy passwords with browser cryptographic randomness and policy controls - Free secure password generator
UUID / GUID Batch Generator
Generate batches of up to 10,000 cryptographically secure UUID v4 (random) or UUID v7 (time-ordered) identifiers in your browser - Free online UUID generator
AES File Encryptor/Decryptor
Encrypt and decrypt files locally using AES-256-GCM with PBKDF2 passphrase-based key derivation - Free online AES file encryptor
Frequently Asked Questions About Bcrypt Hash Generator
A bcrypt hash generator is a tool that applies the bcrypt password hashing function to a plain-text password and produces a secure, salted hash string. Our bcrypt hash generator runs entirely in your browser - no passwords are sent to any server - and supports both hash generation and hash verification.
MD5 and SHA-256 are fast hash functions designed for data integrity, not password storage. An attacker with a GPU can compute billions of MD5 hashes per second. bcrypt is intentionally slow - its cost factor makes brute-force attacks exponentially more expensive. At cost 10, bcrypt takes ~100ms per hash, limiting an attacker to roughly 10 guesses per second per core.
Cost 10 is the industry-standard default and is recommended for most production applications. It provides a good balance between security and performance (~100ms per hash on modern hardware). Use cost 12 for high-security applications where login latency is acceptable. Avoid cost 4 in production - it is only suitable for automated testing.
bcrypt is based on the Blowfish cipher, which uses a key schedule that processes at most 72 bytes. Any bytes beyond the 72nd are silently ignored. This means two passwords that share the same first 72 bytes will produce the same hash. For passwords that may exceed this limit, a common mitigation is to pre-hash the password with SHA-256 before passing it to bcrypt.
The $2a$ variant had a bug in how it handled passwords containing non-ASCII characters on some platforms. The $2b$ variant (introduced in OpenBSD 5.5) fixes this bug and is the current recommended version. Our bcrypt hash generator always produces $2b$ hashes. Most modern bcrypt libraries accept both $2a$ and $2b$ hashes for verification.
Absolutely. All bcrypt computation happens locally in your browser using JavaScript. Your passwords are never sent to any server, logged, or stored anywhere. Once you close or refresh the page, all input is gone permanently. This tool is safe to use with real passwords for testing purposes.
Yes. Switch to Verify mode, enter the plain-text password and the full 60-character bcrypt hash string (starting with $2b$ or $2a$). Our bcrypt hash generator will recompute the hash using the embedded salt and cost factor and compare it to the stored hash. This works with hashes generated by any standard bcrypt implementation.
Yes! Our bcrypt hash generator is 100% free with no signup, no ads, and no usage limits. Hash and verify as many passwords as you need - completely free, forever.
The cost factor is the base-2 logarithm of the number of key expansion iterations. Cost 10 = 1,024 iterations, cost 12 = 4,096 iterations, cost 14 = 16,384 iterations. Each increment doubles the computation time. This adaptive design means you can increase the cost factor as hardware gets faster, keeping bcrypt resistant to brute-force attacks over time.