How to use Bcrypt Hash Generator & Checker
The Bcrypt Hash Generator and Checker hashes passwords using the bcrypt algorithm and verifies a plain-text password against an existing hash — entirely in your browser using bcryptjs. Bcrypt is the industry-standard algorithm for storing passwords: it incorporates a random salt automatically, applies a configurable work factor, and is intentionally slow to resist brute-force and GPU-accelerated cracking attacks. Nothing you enter is ever uploaded to a server.
- Select the operation: "Hash password" to generate a new bcrypt hash, or "Check password" to verify one.
- Enter the plain-text password in the input field.
- For hashing, choose a cost factor (10 is the default; higher values are slower but more resistant to cracking).
- Click Hash to compute the bcrypt string — it includes the algorithm version, cost factor, salt, and hash all in one $2b$... string.
- To verify, paste an existing bcrypt hash in the second field and click Check — the result confirms whether the password matches.
Your data never leaves your device — 100% private processing.
How bcrypt works internally
Bcrypt is based on the Blowfish block cipher. It uses a key-setup algorithm called Eksblowfish (Expensive Key Schedule Blowfish) that iterates 2^cost times, making hash computation deliberately expensive. A 128-bit random salt is generated per hash call, so the same password always produces a different output — this defeats rainbow-table attacks. The final 60-character string encodes the algorithm identifier ($2b$), cost factor, 22-character Base64 salt, and 31-character Base64 hash. Cost factor 10 takes roughly 100 ms on modern hardware; cost 12 takes roughly 400 ms.
| Cost factor | Hashing time (approx.) | Recommended for |
|---|---|---|
| 10 | ~100 ms | Minimum for production; general web apps |
| 11 | ~200 ms | Elevated security applications |
| 12 | ~400 ms | Financial or healthcare apps |
| 13 | ~800 ms | High-value credentials |
| 14 | ~1.6 s | Maximum practical; admin accounts |
Bcrypt vs other password-hashing algorithms
MD5 and SHA-256 are general-purpose hash functions designed to be fast — a modern GPU can compute billions of SHA-256 hashes per second, making brute-force trivial. Bcrypt, scrypt, and Argon2 are purpose-built key derivation functions (KDFs) whose cost is tunable. Argon2 (winner of the 2015 Password Hashing Competition) also binds memory usage to the cost, thwarting ASIC-based attacks. If you are starting a new project, prefer Argon2id; bcrypt remains acceptable for existing systems with a cost factor of at least 10. Never use raw SHA or MD5 for password storage.
Worked examples
Hash structure
Inputs: password 'secret' · cost 12
Result: $2b$12$ + 22-char salt + 31-char hash (60 chars total)
Verify a password
Inputs: candidate password + stored $2b$ hash
Result: match → true / mismatch → false (no decryption)
Cost factor effect
Inputs: cost 10 vs cost 12
Result: ~100 ms vs ~400 ms per hash
Glossary
- Bcrypt
- A password-hashing algorithm based on Blowfish with a tunable cost factor, designed to resist brute-force attacks.
- Cost factor
- The base-2 exponent controlling bcrypt work: cost 10 performs 2^10 (1,024) key-setup iterations.
- Salt
- A random value mixed into the hash input to ensure identical passwords produce different stored hashes, defeating rainbow tables.
- Key derivation function (KDF)
- A function that derives a cryptographic key from a password using deliberate computational cost to slow brute-force attacks.
- Rainbow table
- A precomputed table mapping hash values back to passwords; defeated by per-password salts.
Related reading
Frequently Asked Questions
Why use Bcrypt Hash Generator & Checker?
- Generate bcrypt hashes with a configurable cost factor tuned to your security requirements
- Verify a plain-text password against an existing $2b$ hash to test login validation logic
- Choose cost factor 10–14 with embedded timing guidance to calibrate bcrypt for your hardware
- Understand the $2b$ hash structure: version, cost, salt, and digest encoded in one string
Common use cases
- Hash a test password at cost 12 to benchmark bcrypt timing on a production server
- Verify that a password reset form correctly compares the submitted value to its stored hash
- Generate a bcrypt hash to seed a development database with a known test credential
- Confirm that a legacy MD5 password cannot be verified against a bcrypt-hashed value
- Audit a cost factor choice by comparing hashing time across cost levels 10 through 14
Get weekly tool tips & updates
New tools, power-user tips, and productivity hacks — delivered free every Friday.
No spam, ever. Unsubscribe with one click.
Related Developer Tools
TOTP / 2FA Code Generator
Generate time-based one-time passwords (TOTP) from a secret key online. Compatible with Google Authenticator and 2FA. Free, private TOTP generator.
JSON Schema Validator
Validate JSON data against a JSON Schema online. Get clear, path-based error messages for every violation. Free, private JSON Schema validator.
User Agent Parser
Parse any user-agent string to identify the browser, engine, operating system, and device. Detects your own UA too. Free and private.
Hash Generator
Generate SHA-1, SHA-256, SHA-384, and SHA-512 hashes instantly in your browser. Free, private, and secure for quick checks.
Base64 Encoder & Decoder
Encode text or files to Base64, or decode Base64 strings back to text in seconds. Free, private, and fully in-browser now.
JSON Formatter & Validator
Format, validate, and minify JSON instantly. Includes syntax highlighting, error detection, and a collapsible tree view — free, private, in-browser.
Explore all Developer Tools.