Advertisement
Guide
About the Bcrypt Generator
Bcrypt is a password-hashing function designed specifically for storing passwords safely. Unlike general-purpose hashes such as SHA-256, bcrypt is deliberately slow and its cost is tunable — which is exactly what you want for passwords, because it makes large-scale guessing attacks expensive. It also generates and embeds a random saltautomatically, so identical passwords produce different hashes and precomputed “rainbow table” attacks don't work.
This tool hashes a password at a cost factor you choose, and can verify whether a password matches an existing bcrypt hash. It runs the pure-JavaScript bcrypt implementation locally, so nothing is uploaded.
What the cost factor means
The cost (or “rounds”) controls how much work each hash takes — each increment roughly doublesthe time. A higher cost makes brute-force attacks slower but also makes your own logins slightly slower. A cost of 10–12 is a common balance today; raise it as hardware gets faster. You'll notice the hash takes a moment to compute at higher costs — that delay is the whole point.
Why bcrypt beats a plain SHA hash for passwords
A fast hash like SHA-256 is great for checksums but terrible for passwords: modern GPUs can try billions per second. Bcrypt's deliberate slowness and per-password salt turn that flood into a trickle. If you're building password storage, use bcrypt (or a similar function like Argon2) — never a bare SHA hash.
How to use it
- 1On the Hash tab, enter a password and pick a cost factor.
- 2Generate the hash — the salt is included automatically in the output.
- 3Store that hash (never the plain password) in your database.
- 4On the Verify tab, paste a password and a hash to check whether they match.
Frequently asked questions
Why does the same password produce a different hash each time?
Bcrypt generates a new random salt for every hash and stores it inside the result. That is a security feature — it defeats rainbow tables and hides the fact that two users share a password.
How do I check a password if the hash is different every time?
You do not re-hash and compare strings. Bcrypt reads the salt and cost from the stored hash and recomputes with the same parameters. Use the Verify tab, which does exactly this.
What cost factor should I use?
A cost of 10 to 12 is a common modern default. Higher is more secure but slower; pick the highest value your login latency budget allows.
Is bcrypt better than SHA-256 for passwords?
For passwords, yes. SHA-256 is fast, which helps attackers. Bcrypt is intentionally slow and salted, which is what password storage needs. Argon2 is another strong modern choice.
Does my password leave the browser?
No. Hashing and verification run locally in JavaScript. Nothing is uploaded.