Bcrypt Hash Generator and Verifier

How it works

1. 1

   Enter the password to hash.

2. 2

   Set the cost rounds.

3. 3

   Press Generate and copy the hash.

4. 4

   To check a hash, enter a password and hash in the verify section and press the button.

About the Bcrypt Generator

Bcrypt is a deliberately slow password hashing function with a built-in salt, so the same password produces a different hash every time and guessing is expensive. This tool creates bcrypt hashes at a cost you choose and checks whether a password matches an existing hash, which is useful when seeding users or debugging a login that fails.

What you can do

• Hash a password with a cost from 4 to 15; the label shows how many iterations that means.
• Verify a password against a hash in the $2a$, $2b$ or $2y$ format and see Match or No match.
• Get a warning when a password is longer than 72 bytes, the most bcrypt will read.
• Copy the finished hash with one click.

When it works best

• Creating a hashed password for a seed file or an admin user inserted by hand.
• Checking whether a stored hash in the database really matches the password a user says they set.
• Comparing how long different cost values take before you change your application setting.

Things to know

• Hashing and verifying run in your browser with the bcryptjs library; passwords are not sent anywhere.
• Higher costs double the work for each step and can take several seconds at 14 or 15, so the button waits while it runs.
• Characters beyond 72 bytes are ignored, so two long passwords that start the same can match the same hash.
• Bcrypt is for passwords only. For checksums use the Hash Generator, and to create a strong password use the Password Generator.

Frequently asked questions