Password (bcrypt)

Generate & verify salted bcrypt password hashes.

Generate a salted, slow bcrypt password hash with an adjustable cost factor, and verify a password against an existing bcrypt hash. The right way to store passwords — runs fully in your browser, nothing is uploaded.

How to use Password (bcrypt)

  1. Pick a mode

    Choose Generate to create a new bcrypt password hash, or Verify to check whether a plain password matches an existing hash, all free and in your browser.

  2. Enter the password

    Type the password you want to hash into the field, using the show or hide toggle to confirm it is exactly right before the bcrypt generator processes it.

  3. Set the cost factor

    Drag the salt-rounds slider to tune how slow and strong the bcrypt hash is; 10 to 12 is the recommended range for most web apps and logins.

  4. Generate the hash

    Click Generate hash and a unique, salted bcrypt password hash appears instantly, ready to copy and store safely in your user database.

  5. Copy the bcrypt hash

    Use the copy button to grab the full hash string, which already bakes in the algorithm, cost factor and random salt that protect every password.

  6. Verify a password

    Switch to Verify, paste a bcrypt hash starting with $2a$, $2b$ or $2y$, enter the password, and the tool instantly confirms whether the two match.

Frequently asked questions

What is a bcrypt hash generator and how does it work?

A bcrypt hash generator turns a plain password into a salted, slow one-way bcrypt hash that is safe to store in a database. This free online bcrypt generator runs entirely in your browser using an adjustable cost factor, so the same password produces a different hash every time thanks to the built-in random salt.

How do I verify a password against a bcrypt hash?

Switch to the Verify tab, paste the bcrypt hash (it starts with $2a$, $2b$ or $2y$) and type the password you want to check. The tool runs bcrypt.compare and tells you instantly whether the password matches the hash — the same way a login system checks a password without ever decrypting it.

What cost factor or number of salt rounds should I use for bcrypt?

A cost factor of 10 to 12 is the common recommendation for web apps in 2024 and beyond. Higher rounds make the hash slower and harder to brute-force but also slower to compute, so balance security against the login time your server can afford.

Can a bcrypt hash be decrypted or reversed?

No. bcrypt is a one-way hashing function, so a bcrypt hash cannot be decrypted back into the original password. You verify a password only by hashing the input and comparing it, which is why bcrypt is the standard for secure password storage.

Is this bcrypt generator safe and is my password uploaded anywhere?

Yes, it is safe. All hashing and verification happen 100% in your browser with the bcryptjs library — your passwords are never sent to a server, logged or stored. You can even use it offline once the page has loaded.

Why does the same password give a different bcrypt hash each time?

bcrypt mixes in a new random salt on every run, so identical passwords produce different hashes. This is intentional and a security feature — it stops attackers from using precomputed rainbow tables and means two users with the same password still get unique stored hashes.

Should I use bcrypt or MD5/SHA-256 for storing passwords?

Use bcrypt for passwords. MD5 and SHA-256 are fast general-purpose hashes meant for checksums, which makes them weak for password storage because they can be brute-forced quickly. bcrypt is deliberately slow and salted, so it is the right choice for hashing passwords.

Is bcrypt still secure in 2026?

Yes. bcrypt remains a solid, widely-recommended password hash because it's deliberately slow and salted, which resists brute-force and rainbow-table attacks. For new systems, argon2 and scrypt are also strong modern options, but bcrypt with a cost factor of 10–12 is still a safe, standard choice.

What do the $2a$, $2b$ and $2y$ prefixes in a bcrypt hash mean?

They're version identifiers for the bcrypt algorithm. $2a$ is the original, $2b$ is the current corrected version, and $2y$ comes from some PHP implementations — all are compatible for verification. The number after them (like $10$) is the cost factor. This tool accepts any of these prefixes when verifying.

Related tools — Security & Encoding