Bcrypt Password Hasher

How to use: step by step

1. 1
   Choose Hash or Verify mode
   Select Hash to generate a bcrypt hash from a plaintext password, or Verify to check whether a password matches a stored hash.
2. 2
   Enter your password
   Type or paste the password. Use the eye icon to toggle visibility. The field is never auto-completed.
3. 3
   Set salt rounds (hash mode)
   Drag the slider between 4 and 12. The default of 10 balances security and speed. Higher rounds are exponentially slower but more resistant to cracking.
4. 4
   Click Hash Password
   The bcryptjs library runs the Blowfish key schedule entirely in your browser tab: no server call is made.
5. 5
   Copy the hash or check the result
   In hash mode, copy the $2b$ hash string. In verify mode, a clear match/no-match result is shown instantly.

Frequently Asked Questions

Is bcrypt hashing done server-side?

No. This tool uses the bcryptjs library, which is a pure-JavaScript implementation that runs entirely in your browser. Your password is never transmitted.

What salt rounds should I use?

OWASP recommends a cost factor of 10 or higher for production use. Increase it as hardware improves. A round of 12 is a good modern choice for most applications.

Why does bcrypt take longer with higher salt rounds?

Bcrypt is deliberately slow. Each additional round doubles the computation time, making offline brute-force attacks proportionally harder.

Can I recover the original password from a bcrypt hash?

No. Bcrypt is a one-way function. The only way to check a password is to hash the candidate with the embedded salt and compare.

What is the maximum password length for bcrypt?

Bcrypt truncates input at 72 bytes. For passwords longer than 72 bytes, consider pre-hashing with SHA-256 before bcrypt.

What does the $2b$ prefix mean?

It denotes the bcrypt algorithm version. $2b$ is the current canonical version. Older hashes may start with $2a$ or $2y$.

Can I use this hash in a database?

Yes. The $2b$ output is a standard bcrypt hash string that works with bcrypt libraries in Node.js, PHP, Python, Go, and most other languages.

Is bcrypt still recommended?

Yes for most applications. Argon2id is the newer OWASP first choice, but bcrypt with a cost of 10–12 remains widely accepted and secure.

How do I store a bcrypt hash in a database?

Store the full $2b$ hash string as a VARCHAR(60) column. It is exactly 60 characters long and contains the algorithm version, cost factor, salt, and hash all in one string. Never store the plaintext password or a separate salt column: bcrypt embeds everything needed for verification in the hash itself.

Why does the same password produce a different hash each time?

Bcrypt generates a new random 128-bit salt for every hash operation. The salt is embedded in the output string, which is why two hashes of the same password look completely different. This prevents pre-computation attacks such as rainbow tables.