Bcrypt Password Hasher

Free online Bcrypt password hashing and verification with adjustable cost (4-14) and built-in salt. Runs entirely in your browser.

Runs locally · data never uploaded
Advertisement

How to use

What it does

Bcrypt is an adaptive hash designed for password storage: it bakes in a random salt and tunes its cost (work factor) to resist brute force and GPU acceleration. This tool generates a hash and verifies whether a plaintext matches an existing hash, all in your browser.

Example

In "Hash" mode, set the plaintext to password123 and cost to 10; you get something like:

$2a$10$urrpc8gKmopBnjfGTfsgF.adTHF.2.UEX6.3ig7TrUCoCYy6w.LIi

Switch to "Verify", type password123 again, paste that hash, and "Execute" returns "Match ✓".

Cost

Cost is the exponent of 2 for the iteration count: each +1 roughly doubles the time. 10 is a common default; 12 suits more sensitive systems. Because this runs in the browser, very high cost will feel sluggish.

FAQ

Q1.How is Bcrypt different from MD5/SHA?
MD5/SHA are extremely fast and unfit for passwords because attackers can try billions per second. Bcrypt is deliberately slow and tunable, with a built-in salt, made specifically for password storage.
Q2.Why is the hash different every time?
Bcrypt generates a fresh random salt and stores it in the result (the part after `$2a$10$`). The same password yields different hashes, but verification extracts the salt and still matches correctly.
Q3.What cost should I use?
Usually 10-12. Higher is safer but slower; pick a value that takes about 100-250 ms per hash on your hardware and raise it as machines get faster.
Q4.Is my password uploaded?
No. Hashing and verification happen in JavaScript inside your browser; the tool works offline and the plaintext stays on your device.
Advertisement

Related tools