Input
Preparing your workspace…
How to use
- Choose Generate hash or Verify password and enter the password.
- Set a generation cost, or paste the hash to verify.
- Run the action and copy the new hash or read the match result.
bcrypt Generator
bcrypt is an adaptive, one-way password-hashing function. A generated hash contains its version, cost and salt. Use verification to check a candidate password against an existing hash.
Generation and verification are separate actions. Cost is read from the existing hash when verifying, so changing the generation setting does not change the meaning of a stored hash.
Work with the input
Choose Generate hash or Verify password. Enter a password of 1–72 UTF-8 bytes.
For generation choose cost 4–14, default 10. For verification paste a supported bcrypt hash; its stored cost is used.
Hash parameters: Version ($2a$ / $2b$ / $2y$), Cost factor, Salt.
Password: demo-password · cost: 10A new $2b$10$ hash with a random salt; verify it using the same password.Example data only. Never reuse sample secrets as real credentials.
Behavior and limits
Inputs longer than 72 UTF-8 bytes are rejected instead of silently truncated. Unicode characters can use several bytes. $2a$, $2b$ and $2y$ hashes are accepted, subject to the local cost limit of 14. This browser utility does not choose your production password-storage policy or recover plaintext from a hash.
Copy and reuse
Select the action button. Copy the hash, or read the match result. Every new generation uses a fresh random salt.
Input: 1 MiB; Secret key: 64 KiB; File: 1 GiB; Passwords: 4–128 (Length), 1–100 (Count); bcrypt: 1–72 UTF-8 bytes · cost 4–14 · default 10; AES: Plaintext 1 MiB, Passphrase 1 KiB, GCM / CBC / CTR / CFB / ECB, 128/192/256-bit; PBKDF2 / HKDF: Password / input bytes 64 KiB, Salt / info 1 KiB, Output length (bytes) 1–256; 1–256 output bytes · up to 2,000,000 PBKDF2 iterations · inputs stay on your device; Time: 30 s; File: 120 s.
Frequently asked questions
Why are hashes different for the same password?
Each generation uses a fresh random salt. Verify a candidate against the full stored hash rather than comparing two newly generated hashes.
Can I use more than 72 characters?
The limit is 72 UTF-8 bytes, not characters. This tool rejects longer input during generation and verification rather than silently truncating it.
Which cost is used when verifying a hash?
The cost stored in the supplied hash is used. The generation cost selector does not override it.
Does verification reveal the original password?
No. It checks the candidate you enter against the supplied hash and returns a match or mismatch result.
Can I verify hashes with cost above 14?
This browser tool accepts cost 4–14 for generation and verification. Use a compatible trusted implementation for a hash outside that range.