Bcrypt Hash Generator
Generate bcrypt password hashes with an adjustable cost factor (4-15) and verify existing hashes. Free online bcrypt generator with $2a$, $2b$, $2y$ support.
Loading tool...
What is Bcrypt Hash Generator?
Bcrypt Hash Generator creates secure, salted password hashes using the bcrypt algorithm — the industry standard for password storage. Unlike fast hashes such as MD5 or SHA-256, bcrypt is intentionally slow and includes an adjustable cost factor so it stays resistant to brute-force attacks as hardware improves.
Key Benefits
- Automatic per-hash salt prevents rainbow table attacks
- Adjustable cost factor for future-proofing against faster hardware
- Designed specifically for passwords — intentionally slow to compute
- 100% client-side processing, nothing is uploaded
- Compatible with Node.js, Python, PHP, Ruby, and Go bcrypt libraries
Common Use Cases
- •Hashing passwords before storing them in a database
- •Verifying a user-supplied password against a stored bcrypt hash
- •Migrating away from MD5/SHA-1 to a secure password hash
- •Testing authentication logic during development
- •Security audits and password-strength demonstrations
How to Use the Bcrypt Hash Generator
- Enter your password: Type or paste the password you want to hash into the password field.
- Choose a cost factor: Select a cost factor (default 10). Higher values are more secure but slower. Use 12 or higher for production credentials.
- Generate the hash: Click Generate Hash. The tool creates a unique salt and produces a bcrypt hash string starting with $2a$, $2b$, or $2y$.
- Copy or verify: Copy the generated hash, or switch to the Verify tab to check whether a known password matches an existing bcrypt hash.
Key Features
- Adjustable cost factor from 4 to 15
- Verify existing bcrypt hashes against a password
- Supports $2a$, $2b$, and $2y$ hash variants
- 100% client-side — no data leaves your browser
- Automatic salt generation for every hash
- One-click copy of the generated hash
Frequently Asked Questions
What is the bcrypt cost factor?
The cost factor (also called work factor) determines how many rounds of the Blowfish-based key setup run. Each increment doubles the computation time. Cost 10 takes about 100ms on modern hardware, while cost 12 takes about 400ms. Choose the highest value your users can tolerate during login.
Why does bcrypt truncate passwords longer than 72 bytes?
Bcrypt is built on the Blowfish cipher, which uses 72-byte (448-bit) keys internally. Passwords longer than 72 bytes are silently truncated. To handle long passwords, pre-hash with SHA-256 before bcrypt (e.g. bcrypt(base64(sha256(password)), salt)).
What is the difference between $2a$, $2b$, and $2y$?
These are version identifiers. $2a$ is the original implementation. $2b$ is a fixed version from the OpenBSD maintainers that corrects a wrap-around bug. $2y$ is used by PHP/Crypt. All three produce compatible hashes — bcryptjs can verify any of them.
Is it safe to use this tool for real passwords?
Yes. All hashing happens entirely in your browser using bcryptjs — your password never leaves your device. However, for production systems, always hash server-side and store hashes in a secure database with additional protections like rate limiting and MFA.