Bcrypt Hash Generator and Verifier

A bcrypt hash generator, sometimes called a bcrypt password hash generator, turns a plaintext password into a secure bcrypt hash. Bcrypt is a password-hashing function built on the Blowfish cipher, designed by Niels Provos and David Mazières in 1999. Unlike fast hashes such as MD5, bcrypt is deliberately slow to resist brute-force attacks.

This tool produces a standard 60-character hash that any bcrypt library can verify. It also works as a bcrypt verifier, checking whether a password matches a hash you already hold. Both actions happen entirely on your device, so no password is ever sent to a server.

Using this online bcrypt hash generator takes seconds and needs no account or install. The tool runs in any modern browser on desktop and mobile. Follow the steps below to generate or verify a hash.

The generator creates a fresh random salt every time you run it. This means the same password produces a different hash on each generation. That behaviour is correct and expected, and the verify function is how you confirm a match.

Every bcrypt hash follows a fixed structure that packs four parts into one string. Reading it helps you debug authentication issues and confirm a hash is valid. The example below shows each segment of a real bcrypt hash.

A hash such as $2b$10$oHLkY4emC3geWiN6anPYnevZAh9RtyHgQeOeGwWbWF9xlJidZsQDi breaks down cleanly. The $2b$ marks the bcrypt version, 10 is the cost factor, the next 22 characters are the salt, and the final 31 characters are the hash. The whole string is always 60 characters long, which makes malformed hashes easy to spot.

The version prefix tells libraries which bcrypt variant produced a hash. Most modern libraries default to $2b$, the current OpenBSD version. You will still encounter older or language-specific prefixes in real systems.

The $2a$ prefix is the original and remains widely compatible across libraries. PHP and Laravel produce $2y$ hashes, which come from the crypt_blowfish implementation. All three verify the same way, so a $2y$ hash from PHP checks correctly against the right password. This bcrypt hash generator outputs a standard prefix that any compliant library accepts.

The cost factor, also called the work factor, controls how slow each hash is. Raising it by one doubles the computation time, because the rounds equal 2 to the power of the cost. A cost of 10 means 1,024 rounds, while a cost of 12 means 4,096 rounds.

Higher cost values resist brute-force attacks better but slow down every login. A value between 10 and 12 balances security and speed for most web applications today. Test the timing on your own hardware, aiming for roughly 250 milliseconds per hash. This bcrypt hash generator online lets you preview how each cost setting affects the output.

Verifying is essential because you cannot compare two bcrypt hashes directly. The same password produces a different hash every time, thanks to the random salt. String comparison always fails, so a proper verifier is the only reliable method.

The verifier extracts the salt and cost from the stored hash, then rehashes your plaintext with those exact values. If the result matches the stored hash, the password is correct. Paste the hash and the candidate password into this tool to run that check safely in your browser.

Bcrypt is the default password algorithm across most modern web frameworks. PHP's password_hash() function uses bcrypt by default and returns a $2y$ hash. Laravel wraps this in its Hash::make() helper, which is why a Laravel hash generator and a bcrypt generator produce the same format.

Node.js developers reach for the bcrypt or bcryptjs packages to achieve identical results. Every one of these produces the standard 60-character output this tool creates. You can generate a test hash here and drop it straight into your database seed or fixture.

Bcrypt combines three defences that fast hashes like SHA256 lack entirely. It salts every hash automatically, so identical passwords never share a digest. It is deliberately slow, which throttles brute-force and dictionary attacks to a crawl.

Its adaptive cost factor is the third and most important advantage. As hardware gets faster, you raise the cost to keep hashes expensive to crack. A hash created today can stay secure for years simply by choosing a sensible work factor. For creating the passwords themselves, pair this tool with our Password Generator.

Bcrypt only processes the first 72 bytes of any password. Characters beyond that point are ignored, which can weaken very long passphrases unexpectedly. Older libraries truncated silently, while newer ones reject overlong input with an error.

This limit is why WordPress pre-hashes passwords with SHA-384 before applying bcrypt. If your passwords may exceed 72 bytes, hash them once with SHA-256 first, then bcrypt the result. For WordPress-specific hashes, use our dedicated WordPress Password Hash Generator instead. To inspect non-password digests, the Hash Generator covers MD5 through SHA-512.