Bcrypt Hash Generator & Verifier

Generate secure bcrypt password hashes with a configurable cost factor, and verify passwords against existing hashes. Runs entirely in your browser — your passwords are never sent to a server.

All hashing and verification runs entirely in your browser using the bcryptjs library. No data is ever transmitted to a server.

Password

Cost Factor (Rounds) 10

4 (fastest) 12 (most secure)

Password

Bcrypt Hash

Bcrypt verification rehashes the password using the salt embedded in the hash, then compares the result. This is why you do not need to store the salt separately — it is already part of the hash string.

About Bcrypt

Bcrypt is a password hashing function designed by Niels Provos and David Mazières in 1999. It incorporates a salt to protect against rainbow table attacks and an adjustable cost factor that makes it intentionally slow — meaning it stays resistant to brute-force attacks even as hardware improves.

How it works

A random salt is generated and prepended to the password before hashing.
The password is hashed using the Blowfish cipher with 2^cost rounds of key expansion.
The resulting hash string embeds the algorithm version, cost factor, and salt — so you only need to store one string.
To verify, the same process is repeated using the salt from the stored hash, and the results are compared.

Choosing a cost factor

Cost 10 — the current recommended default for most applications. Takes ~60ms on modern hardware.
Cost 12 — recommended for high-security applications. Takes ~240ms.
Cost 4–6 — only for testing. Too fast to be secure in production.
A good rule of thumb: choose the highest cost factor that keeps login time under 100ms for your users.

Reading a bcrypt hash

A bcrypt hash like $2b$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy contains: $2b$ (algorithm version), 10$ (cost factor), followed by 22 characters of salt and 31 characters of hash — 60 characters total.