Bcrypt Hash Generator
Generate secure bcrypt password hashes with a random salt directly in your browser. Free, fast, and fully client-side.
Your input never leaves your device.
Higher cost means more secure but slower. Cost 10 is a reasonable default.
Verify a Bcrypt Hash
What is Bcrypt?
Bcrypt is a password hashing function designed by Niels Provos and David Mazières, based on the Blowfish cipher. It is widely used to store passwords securely because it is deliberately slow and incorporates a random salt into every hash.
Unlike general-purpose hash functions such as SHA-256, bcrypt is built specifically for passwords. Its slowness is a feature: it makes brute-force and dictionary attacks significantly more expensive, so even if a database is leaked, cracking the passwords becomes impractical.
Bcrypt is a one-way hashing function, not encryption. A bcrypt hash cannot be decrypted back to the original password. Verification is done by hashing the candidate password with the same salt and comparing the results.
How to Generate a Bcrypt Hash
- 1
Enter a password or text into the input field.
- 2
Choose the bcrypt cost / rounds factor.
- 3
Click Generate to create the bcrypt hash with a fresh random salt.
- 4
Copy the generated bcrypt hash for use in your application.
What is Bcrypt Cost / Rounds?
The bcrypt cost factor (also called rounds) controls how computationally expensive the hashing is. Each increment of the cost roughly doubles the work required, because the underlying key schedule runs 2^cost iterations.
A higher cost means a slower hash and therefore stronger resistance to brute-force attacks — but also more CPU time on your server when verifying passwords. A lower cost is faster but weaker.
There is no single 'best' cost for everyone. The right value depends on your server hardware and how many password hashes you process. A cost of 10 to 12 is a common starting point; you should tune it so that hashing takes a small but acceptable amount of time on your target hardware.
Is this Bcrypt Generator Secure?
- •All bcrypt computation happens locally in your browser. Your password input is never uploaded to the UtilForge server.
- •This tool does not store your input in localStorage, does not write it into URLs, and does not send it to any analytics or tracking service.
- •Do not use real production passwords in any third-party tool if you are not comfortable doing so. This tool is intended for testing, development, learning, and verification.
- •For production systems, always perform bcrypt hashing on your own trusted server using a battle-tested library.
Bcrypt vs SHA-256
SHA-256 is a fast, general-purpose cryptographic hash. That speed is exactly why it is a poor choice for password storage on its own: an attacker can test billions of SHA-256 guesses per second on modern hardware.
Bcrypt is purpose-built for password hashing. It is intentionally slow and has an adjustable cost factor, so you can increase the work required as hardware gets faster. This dramatically raises the cost of brute-force attacks.
Remember: bcrypt is hashing, not encryption. It cannot be reversed, and it is designed to protect passwords at rest — not to encrypt data.
Related Tools
Frequently Asked Questions
What is a bcrypt hash?
A bcrypt hash is a fixed-length string produced by the bcrypt password hashing function. It contains the algorithm version, the cost factor, a random salt, and the resulting digest — for example $2b$10$... . Because each hash embeds its own salt, the same password produces a different hash every time.
Is bcrypt encryption or hashing?
Bcrypt is hashing, not encryption. Hashing is a one-way function: you can turn a password into a hash, but you cannot turn the hash back into the password. Encryption, by contrast, is reversible with the correct key.
How does bcrypt work?
Bcrypt derives its design from the Blowfish block cipher. It generates a random salt, combines it with the password, and runs an expensive key schedule repeatedly (2^cost times) to produce the final digest. The salt and cost are stored inside the hash so verification can reproduce the same computation.
What is bcrypt cost?
The cost factor determines how many iterations of the key schedule bcrypt runs. Each increase of 1 doubles the work. Cost 10 is a common default, while 12 or 13 take progressively longer but are stronger against brute force.
What is the difference between bcrypt and SHA-256?
SHA-256 is fast and general-purpose, which makes it unsuitable for password storage by itself. Bcrypt is intentionally slow with an adjustable cost, making it much harder to crack passwords through brute force. For passwords, use bcrypt (or another dedicated password hashing function) instead of plain SHA-256.
Can I generate bcrypt hashes in my browser?
Yes. This tool runs the bcrypt algorithm entirely in your browser using JavaScript. No server round-trip is required, and your input stays on your device.
Does this Bcrypt Generator send my password to a server?
No. All hashing is performed client-side. Your password is never transmitted, stored, or logged. This page does not use any analytics or tracking for your input.
Can bcrypt hashes be decrypted?
No. Bcrypt is a one-way hashing function. A bcrypt hash cannot be decrypted back to the original password. The only way to check a password is to hash it again with the same salt and compare the result.
Bcrypt vs Argon2 — which should I use?
Both are dedicated password hashing functions and both are good choices. Bcrypt has been battle-tested since 1999 and is supported by every major language. Argon2 won the Password Hashing Competition in 2015 and adds memory and parallelism parameters that make it stronger against GPU cracking. Argon2id is increasingly the default recommendation for new projects; bcrypt remains a safe, portable choice.
Does bcrypt have a password length limit?
Yes. Bcrypt only uses the first 72 bytes of the input — longer passwords are silently truncated by most libraries. If your application must accept very long passphrases, pre-hash the password (for example with SHA-256) before bcrypt, or consider Argon2.
What do $2a$, $2b$ and $2y$ in a bcrypt hash mean?
The prefix identifies the bcrypt algorithm version. $2a$ is the original; $2b$ fixed a bug in the handling of 8-bit characters and is the current recommendation; $2y$ is the PHP/crypt equivalent of $2b$. All three verify interchangeably in practice — the prefix mainly matters for library compatibility.
Can I use this hash in Node.js, PHP or Python?
Yes. Bcrypt is a standard algorithm, so a hash generated here works anywhere bcrypt is implemented: Node.js (the bcrypt or bcryptjs package), PHP (password_hash() with PASSWORD_BCRYPT), Laravel (Hash::make()), and Python (the bcrypt package). Because each hash embeds its own salt, hashes from different libraries are fully interchangeable.
Found an issue with this tool?
Report a problem