Bcrypt Hash Generator & Verifier

Type a password to get a bcrypt hash with a fresh random salt, or paste an existing hash to check whether a password matches it. Hashing runs on this page with the open-source bcrypt.js library, so the password is not sent anywhere. The page also warns you when a password is longer than the 72 bytes bcrypt actually uses.

On-device — downloads its library once Security Free · no signup

Network notice: Your passwords and hashes never leave your device. The open-source bcrypt.js library (Apache 2.0 license) is fetched from the cdnjs CDN the first time you generate or check a hash.

How to use

Type the password or text to hash. Tick Show password to see what you typed. The counter under the field shows how many of bcrypt's 72 bytes it uses.
Set the cost factor. Each step doubles the work for an attacker and for your server on every login. 12 is a sensible default for most servers, and 10 is the minimum worth using today.
Leave the prefix on $2b$ unless your system needs $2y$ (PHP) or $2a$ (very old software).
Click Generate hash. The result appears with a breakdown of its prefix, cost, salt and hash parts, and the page shows how long it took in your browser. Copy it into your user database or config.
To check a password, paste a hash under Verify a password, type the password and click Verify. The page checks the hash format first and explains what is wrong if it is not a valid bcrypt hash.

Examples

Password "password", cost 5, $2b$ (this salt is fixed for the example; real hashes use a random one)

$2b$05$2GnMsGt1s1jxC1Q8wT93veR4T75qP9W2djV7WUnyPl5am3JA5ZI72

The same hash with the $2y$ label (PHP password_hash) — verifies the same way

$2y$05$2GnMsGt1s1jxC1Q8wT93veR4T75qP9W2djV7WUnyPl5am3JA5ZI72

OpenBSD test vector: password "U*U", cost 5

$2a$05$CCCCCCCCCCCCCCCCCCCCC.E5YPO9kmyuRGyh0XouQYb4YMJKvyOeW

Anatomy of a hash

$2b$    12$   R9h/cIPz0gi.URNNX3kh2O   PST9/PgBkqquzi.Ss7KIUgO2t0jWMUW
prefix  cost  salt (22 chars)          hash (31 chars)

Supported formats

Output: a 60-character hash in the modular crypt format: $2b$ (or $2y$ / $2a$), a two-digit cost, a $, then 22 characters of salt and 31 characters of hash, using bcrypt's own Base64 alphabet (./A-Za-z0-9).
Verify: accepts $2a$, $2b$ and $2y$ hashes with a cost from 04 to 31. $2y$ is treated as $2b$; they are the same algorithm with a different label.
Passwords are encoded as UTF-8 before hashing, the same as PHP, Python bcrypt, Node bcrypt and OpenBSD.

Privacy

Your input is processed in your browser and is never uploaded. The first time you use the tool, your browser downloads its open-source processing library from cdnjs.cloudflare.com — the library is downloaded, your data is not sent. Privacy policy.

Limitations

bcrypt only uses the first 72 bytes of a password; anything after that is ignored, so two long passwords that start with the same 72 bytes give the same hash. Accented and non-Latin characters take 2 to 4 bytes each in UTF-8, so the limit can be reached well before 72 characters. The page counts bytes and warns you.
The page generates costs from 4 to 15. JavaScript bcrypt is several times slower than a native server library, so the time shown is for this browser, not your server. Cost 13 and up can take several seconds here.
$2x$ hashes (from an old, buggy version of crypt_blowfish) and the obsolete $2$ form are rejected rather than checked.
Some $2a$ implementations, notably PHP's crypt_blowfish, apply a safety tweak to passwords with non-ASCII characters, so a $2a$ hash of such a password made elsewhere may not match here. $2b$ and $2y$ hashes are unaffected.
This is a tool for creating and testing individual hashes. It does not crack or reverse hashes; bcrypt cannot be decoded back to the password.

FAQ

What cost factor should I use?

Choose the highest cost your login server can handle comfortably, usually one where a single hash takes around a quarter of a second on the server. For most servers today that is 11 to 13; 12 is a common default. Each step up doubles the time, so going from 12 to 13 halves how many guesses an attacker can make per second. Measure on your real server, because the time shown here is for JavaScript in your browser.

What is the difference between $2a$, $2b$ and $2y$?

They mark the version of the bcrypt algorithm. $2a$ was the 1999 label. In 2014 OpenBSD fixed a bug with passwords over 255 characters and moved to $2b$. PHP's crypt_blowfish had a different bug with non-ASCII characters and used $2y$ for its fixed version. A correct implementation gives the same result for $2b$ and $2y$, so most libraries accept both. Use $2b$ unless your software expects $2y$.

Why does the same password give a different hash every time?

bcrypt adds a random 128-bit salt to every hash and stores it in the hash itself: it is the 22 characters after the cost. So the same password gives a different hash each time, and every one of them verifies correctly. The salt means identical passwords do not produce identical hashes in a database.

Why does bcrypt ignore characters after 72 bytes?

bcrypt feeds the password into the Blowfish key schedule, which takes at most 72 bytes. Anything longer is cut off. If you need longer passphrases to count in full, some systems hash the password with SHA-256 or HMAC first and then bcrypt the result, but the two sides have to agree on that exact scheme, so it is not something to add on your own.

Is my password sent to a server?

No. The hash is computed in your browser by bcrypt.js, and the salt comes from your browser's secure random generator, crypto.getRandomValues(). The only network request is the one-time download of the bcrypt.js library from cdnjs, which carries no password.

Can a bcrypt hash be decoded or reversed?

No. bcrypt is a one-way function. The only way to find the password is to guess and check each guess, which the cost factor makes deliberately slow. That is why the verifier needs you to type the password.