Bcrypt Generator & Verifier — Password Hash Online

What is Bcrypt Generator?

Bcrypt is the workhorse password-hashing function of the last two decades. Designed by Provos and Mazières in 1999, it's built on the Blowfish cipher's key schedule and has an adjustable cost parameter that lets it scale with Moore's law: each +1 in cost doubles the computation time, so you can push cost up as hardware gets faster. That property is what keeps bcrypt relevant even in 2026: even with GPUs and ASICs, an attacker who steals your database faces years of compute per password at cost 12. Modern alternatives — scrypt, Argon2 — are memory-hard and arguably better against ASIC attackers, but bcrypt remains widely deployed (Rails devise, Django, Node's most popular auth libraries, PHP's password_hash default) and is still considered secure when configured correctly. This tool computes and verifies bcrypt hashes entirely in your browser using bcryptjs — a pure-JS bcrypt implementation.

How to generate a bcrypt hash online

1. 1Enter the password in the input.
2. 2Pick a cost factor (10 is the modern minimum, 12 is common for high-security services). Higher = more secure but slower.
3. 3Click Generate — the hash appears with the actual computation time so you can dial in the right cost for your server hardware.
4. 4To verify: paste an existing bcrypt hash into the Verify field along with a candidate password, and the tool reports whether they match.

Use Cases

Code Examples

import bcrypt from "bcrypt";
const hash = await bcrypt.hash(password, 10);
const match = await bcrypt.compare(password, hash);

import bcrypt
hash = bcrypt.hashpw(password.encode(), bcrypt.gensalt(10))
match = bcrypt.checkpw(password.encode(), hash)

import "golang.org/x/crypto/bcrypt"
hash, _ := bcrypt.GenerateFromPassword([]byte(password), 10)
err := bcrypt.CompareHashAndPassword(hash, []byte(password))

Key Concepts

Cost factor

The number of iterations, expressed as a power of 2. Cost 10 = 2^10 = 1024 iterations of the key schedule; cost 12 = 4× slower; cost 14 = 16× slower.

Salt

A random 128-bit value unique per hash, mixed with the password before hashing. Prevents rainbow tables and makes identical passwords produce different hashes. Bcrypt embeds the salt into the output.

Hash format

$VERSION$COST$SALT+HASH. Version is 2a / 2b / 2y (all bcrypt), COST is 2 digits, then 22 salt chars + 31 hash chars = 53 chars.

Tips & Best Practices

• ▸Never generate the salt yourself — bcrypt.hash generates a random one internally. Manually-set salts are almost always a mistake.
• ▸Bcrypt has a hard 72-byte input limit. For long passphrases or when combining with a pepper, pre-hash with SHA-256 or SHA-512 first (common enterprise pattern).
• ▸Cost is stored inside the hash itself. When you increase cost site-wide, existing users need to re-hash on next login (or you can trigger a rehash if bcrypt.needsRehash returns true).
• ▸Storage: bcrypt hashes are always 60 chars — a VARCHAR(60) or CHAR(60) column is exactly right. Some libraries emit $2y$ instead of $2b$ — they're interoperable.
• ▸For new systems in 2026, Argon2id is the modern recommendation. Bcrypt is fine — but if you're greenfield and your framework supports Argon2, consider it.