Bcrypt Hash Generator
Free bcrypt hash generator and verifier. Hash a password with a chosen salt round count, or check a password against an existing bcrypt hash — entirely in your browser.
⚠️ Bcrypt only uses the first 72 bytes of a password — anything beyond that is silently ignored.
Frequently asked questions
How is bcrypt different from a hash like SHA-256?
SHA-256 is designed to be fast, which is exactly wrong for password storage — fast hashing means an attacker with a stolen hash database can try billions of password guesses per second. Bcrypt is deliberately slow and tunable (via the salt rounds / cost factor), and automatically generates and stores a random salt with every hash, so two users with the same password get completely different hashes. This combination makes brute-forcing bcrypt hashes dramatically more expensive.
What are salt rounds (the cost factor)?
Salt rounds control how many times bcrypt's internal algorithm iterates — each increment roughly doubles the time it takes to compute a hash. A higher value makes brute-force attacks slower, at the cost of also making legitimate logins slower. 10-12 is a common default for interactive applications; going much higher (14+) can take several seconds per hash, even longer in pure-JavaScript implementations like this one than in a native library.
Why does a bcrypt hash start with $2a$, $2b$, or $2y$?
That prefix identifies the bcrypt variant/format version, followed by the cost factor and then the salt and hash themselves, e.g. $2a$10$N9qo8uLOickgx2ZMRZoMy.... The differences between $2a$, $2b$, and $2y$ are historical implementation-detail fixes for edge cases with certain input bytes — in practice, modern bcrypt libraries interoperate between them.
Why does bcrypt only use the first 72 bytes of my password?
It's a limitation baked into the original bcrypt algorithm design — anything beyond 72 bytes is silently truncated and ignored, so a 100-character password and the same password cut to its first 72 bytes produce the same hash. This tool warns you when your input exceeds that limit.
Is it safe to hash a real password in this tool?
Hashing happens entirely in your browser via the bcryptjs library — nothing is sent anywhere. That said, as general good practice, it's safer to test with a throwaway example password rather than an actual account password whenever you're trying out a tool.