BCrypt Hash Generator & Verifier
Generate secure BCrypt password hashes and verify passwords against existing hashes. Configurable cost factor, runs entirely in your browser.
Related Developer Tools
What Is BCrypt Hashing?
BCrypt is a password hashing function designed by Niels Provos and David Mazières, based on the Blowfish cipher. Unlike fast hash functions (MD5, SHA-1), BCrypt is deliberately slow and includes a configurable cost factor that makes brute-force attacks computationally expensive. It is the industry standard for storing passwords securely in web applications.
How to Use
- Hash tab: Enter a password, choose a cost factor (rounds), then click Hash Password.
- Verify tab: Enter the original password and the BCrypt hash, then click Verify to check if they match.
- Copy the generated hash to use in your application.
Features
- Configurable cost factor from 4 (fast) to 14 (very slow, highly secure).
- Hash and Verify modes in a single tool.
- Uses the bcryptjs library — pure JavaScript, runs entirely in browser.
- No data is uploaded to any server — fully private.
FAQ
What cost factor should I use?
The default of 10 is recommended for most applications, taking roughly 100ms per hash. Increase to 12 for higher security if your server can handle the extra load. Never use values below 10 in production. In this browser tool, keep it at 10 or below to avoid long wait times.
Why does BCrypt produce different hashes each time?
BCrypt generates a random salt for each hash. The salt is embedded in the resulting hash string, which is why verification works even though the hash looks different each time.
Can I use this hash directly in my database?
Yes. BCrypt hashes are 60 characters long and contain the algorithm, cost factor, salt, and digest — everything needed for verification. Store the full string in a VARCHAR(60) or TEXT column.