Bcrypt Hash Generator & Checker
Guide: How to Create a Strong Password (and Keep It Safe)
Each +1 doubles the time. 10–12 is typical. Above 12 can take several seconds in a browser.
Everything runs in your browser. bcrypt only uses the first 72 bytes of a password.
Nothing you enter or choose here leaves your device. This tool runs in your browser.
How to use
- 1Choose Generate hash or Check a hash.
- 2To generate, type the password and choose a cost factor.
- 3Click the button and copy the hash.
- 4To check, paste a password and a bcrypt hash and see if they match.
Frequently asked questions
What is bcrypt?
A slow password-hashing function. It adds a random salt and is deliberately expensive to compute, which makes guessing passwords from a stolen database much harder than with fast hashes such as SHA-256.
What cost factor should I use?
10 to 12 is common today. Each step up doubles the work, so choose the highest value that still feels quick for your server, typically 100 to 300 ms per hash.
Why is the hash different every time?
Each hash includes a fresh random salt. That is expected, and the checker still tells you whether a password matches any one of them.
Is it safe to type a real password here?
Hashing runs in your browser and nothing is sent anywhere. Even so, use test passwords for experiments and real hashing code on your server for real accounts.
Read the guides
Learn how this works and how to get the most from it.
Security
How to Create a Strong Password (and Keep It Safe)
Why length beats complexity, how long a password should be, how passphrases work and how developers should store passwords.
2 min read
Security
What Is a Hash Function? MD5, SHA-256 and Bcrypt Explained
Learn what hashing does, why the same input always gives the same hash, which algorithms are still safe, and why passwords need bcrypt.
1 min read
Related tools
Hash Generator
Generate MD5, SHA-1, SHA-256 and SHA-512 hashes and HMACs.
Password Generator
Create strong random passwords or passphrases, one or many at a time.
JWT Decoder
Decode a JSON Web Token and check its expiry and signature.
UUID & Random Number Generator
Generate secure UUIDs (v4, v7) and random numbers.