Bcrypt Hash Generator
Runs in your browser — your data is never uploaded.
Generate a bcrypt hash, or check whether a password matches one you already have. Both run entirely on your own machine — nothing is uploaded, which is the only basis on which a page like this is worth using. The cost factor is yours to set, and the page is explicit about the two things that surprise people: bcrypt ignores everything past 72 bytes, and the $2a$/$2b$/$2y$ prefixes are the same algorithm.
0 characters · runs entirely in your browser
How to use Bcrypt Generator
- 1
Type or paste the password to hash.
- 2
Set the cost factor — 10 is a sensible default, and each step up doubles the work.
- 3
Click “Hash”. To verify instead, paste an existing hash into the compare field.
Share
Embed this tool on your site
Paste this where you want the tool to appear. It runs entirely in your visitor's browser — no uploads, no account, no tracking.
Please keep the attribution line — it's what keeps these tools free.
Need a different size, a dark theme, or a different tool? Build an embed lets you preview it first.
Frequently asked questions
Is my password sent anywhere?+
No. The hashing runs in JavaScript on your device and nothing is transmitted — you can confirm it by opening your browser’s network tab, or by disconnecting entirely and using the page offline. That said, treat any hash of a live production password as something to generate locally on principle; this page is built for setting up new credentials.
What cost factor should I use?+
10 is the common default and 12 is a reasonable target for new systems. Each increment doubles the work, so 12 is four times slower than 10 — for an attacker and for your login endpoint equally. On a current desktop browser that is roughly 70 ms at cost 10, 0.3 s at 12 and 1.1 s at 14, which is a fair reminder of what you are asking your server to do on every single sign-in.
Why is my long passphrase not stronger?+
bcrypt hashes at most 72 bytes and silently discards the rest. A 100-character passphrase is exactly as strong as its first 72 bytes — and in UTF-8 an accented or non-Latin character costs more than one byte, so the cut can come sooner than the character count suggests. Systems needing longer inputs pre-hash with SHA-256 first.
What is the difference between $2a$, $2b$ and $2y$?+
Nothing that matters today. The prefixes record which implementation wrote the hash, after a 2011 bug in PHP’s version prompted a split. All three verify correctly in every current library. Apache’s htpasswd writes $2y$; most modern libraries write $2b$.
Why does the same password give a different hash each time?+
Because a random salt is generated for every hash and stored inside the string. That is the point: two users with the same password get different hashes, so cracking one reveals nothing about the other. It also means you compare with the library’s verify function, never with string equality.