Bcrypt Generator
Hash passwords with bcrypt and verify them — in your browser
What is bcrypt, and why cost matters
Bcrypt is the password-hashing standard because it is deliberately slow: each extra cost level doubles the work, so stolen hash databases resist brute force while logins stay fast. That slowness is tunable — cost 10 today, higher as hardware improves.
What this tool does
- 🔐 Hashes passwords with adjustable cost 4–12
- ✅ Verifies candidates against any bcrypt hash
- 📋 One-click copy of the resulting hash
- ⚡ Runs entirely on your device, no uploads
When to use it
- Minting hashes while developing a login form
- Checking a hash from logs without touching production
- Learning how cost factors change timing
Privacy: passwords and hashes never leave your browser — the CPU work happens locally.
Last updated · 2026-09-01
How hashing works
Passwords go through bcryptjs (self-hosted on this site, no CDN) with a random salt per hash; verification re-hashes the candidate with the stored salt and compares in constant time. Rounds run in small async slices so the page stays responsive.
Why hash here?
Built for passwords, not speed
Real bcrypt with per-hash random salts and constant-time verification — the same algorithm your server uses, not a fast hash mislabeled for passwords.
Adjustable work, verified honestly
Cost 4 to 12 on a slider with a busy indicator, because honest tools show their work instead of freezing the tab in silence.
Safe to paste production hashes
Verification runs 100% locally, so checking a hash from your logs never sends secrets anywhere.
Frequently asked questions
What cost factor should I use?⌄
10 is the sane default: higher costs resist brute force but take longer (cost 12 can take seconds on a phone). Cost 4 is only for tests — never for real passwords.
Can I verify a hash from my server here?⌄
Yes — paste any $2a$/$2b$ hash and the candidate password. Nothing leaves your browser, so production hashes stay private.
Is browser hashing secure?⌄
The algorithm is identical to server-side bcrypt. Just remember: hashing in the browser protects nothing in transit — always hash (or verify) on your server for real accounts.
Frequently asked questions
What cost factor should I use?
10 is the sane default: higher costs resist brute force but take longer (cost 12 can take seconds on a phone). Cost 4 is only for tests — never for real passwords.
Can I verify a hash from my server here?
Yes — paste any $2a$/$2b$ hash and the candidate password. Nothing leaves your browser, so production hashes stay private.
Is browser hashing secure?
The algorithm is identical to server-side bcrypt. Just remember: hashing in the browser protects nothing in transit — always hash (or verify) on your server for real accounts.