Generate bcrypt password hashes with a configurable cost factor, or verify a password against an existing hash. Runs in your browser, nothing uploaded.
First time here? Enter the password Your input is processed locally and disappears when you close the tab.
bcrypt remains the sensible default for password storage, and this free bcrypt hash generator produces and verifies hashes without sending anything anywhere.\n\nThe cost factor is the setting that matters, and it is exponential rather than linear. Going from 10 to 12 quadruples the work, and the tool reports the actual elapsed time so you can feel the difference rather than guessing. That slowness is the whole security property: a login performs one hash, while cracking a leaked database performs billions, so making each one expensive breaks the attacker's economics without inconveniencing your users.\n\nThe salt is embedded in the output, which is why hashing the same password twice gives different results and why you never store a salt separately. Verify mode checks a plaintext password against an existing hash — useful when debugging an authentication flow that is rejecting credentials you believe are correct.\n\nOne genuine gotcha the tool warns about: bcrypt truncates input beyond 72 bytes without complaint. Hashing a long generated token silently ignores everything past that point, which can make two different tokens hash identically. Everything runs in your browser, which matters because a production hash is precisely the thing you should not paste into a stranger's form.
Enter the password
Choose a cost factor
Generate the hash
Or switch to verify mode and check a password against an existing hash
The common default — a good balance
bcrypt is deliberately slow. The cost factor is an exponent, so 12 is four times the work of 10, not 20% more. That slowness is the security property — it is what makes guessing billions of passwords impractical.
Everything runs in your browser, which matters here: pasting a production password hash into a server-side tool hands over the thing you are trying to protect.
Note: bcrypt truncates input beyond 72 bytes. Long passphrases are silently cut, which is a real gotcha when hashing something like a generated token.