Skip to main content

Bcrypt Hasher

Make a bcrypt hash of a password or check a password against a bcrypt hash, with the time each cost takes in your browser. Private: nothing is uploaded.

Password

Bcrypt hash

The hash appears here.

Shortcuts: Ctrl+Enter run · Ctrl+Shift+C copy result · / search (use ⌘ on Mac)

Free Online Bcrypt Hash Generator and Checker

Make a bcrypt hash for a password, or check whether a password matches a hash you already have. The page also shows how long each cost takes, so you can choose a safe setting. It gives developers a quick browser-based way to solve a focused bcrypt hasher task before moving the result into a project.

How to make a bcrypt hash

Choose Make a hash, type the password, pick a cost and press the button. Copy the result into your database or test data.

How to check a password

Choose Check a password, type the password, paste the hash that starts with $2 and press the button. You get a clear match or no match.

Common mistakes

  • Using a low cost such as 4 outside of tests: it is very fast to guess against.
  • Storing the hash in a column shorter than 60 characters, which cuts it and makes every login fail.

Frequently asked questions

What cost should I use?
OWASP recommends a cost of at least 10. Pick the highest cost that keeps a login under about half a second on your server. Each step of +1 doubles the work.
What is the difference between $2a$, $2b$ and $2y$?
They are versions of the same algorithm. $2b$ is current. $2a$ and $2y$ hashes work the same for ordinary passwords and are read by every library.
Why is only part of my long password used?
bcrypt reads at most 72 bytes of a password. Anything longer is ignored, so two long passwords that start the same give the same hash. For long passphrases, hash them with SHA-256 first, or use Argon2.
Is my password sent anywhere?
No. The hash is made on your device. Even so, do not paste a real production password into any website: use it to test and learn.
How do I use this bcrypt hasher tool?
Use the interactive controls above; processing stays in your browser and the result is intended as a practical starting point for development work.

More Security & Auth

View all Security & Auth tools →