Bcrypt Hash Generator
Understand Bcrypt Hash Generator
Hashes a password with a configurable cost factor into the $2b$ format, and checks a password against a hash it produced.
How it works
Password hashing is slow on purpose. The cost factor is an exponent, so each increment doubles the work: cost 12 costs four times what cost 10 costs, and an attacker guessing offline sees the same slowdown. A 16-byte random salt is generated per hash and stored inside the output string, so two users who chose the same password get different hashes and one precomputed rainbow table cannot attack a whole database. The work itself is the Blowfish key schedule run 2^cost times — that expensive setup is the whole point of the algorithm, and it is what makes bcrypt resist the GPU parallelism that makes a fast hash like SHA-256 a poor choice here.
When to use it
- Seeing how long a single hash takes at each cost factor before you raise it in production.
- Reading the parts of a $2b$ string — version, cost, salt, digest — while debugging a login problem.
- Learning why a stored password hash carries its own salt rather than a shared one.
- Generating a throwaway hash for a local fixture or seed script where the value is not a real credential.
Watch out for
- Cost is a exponent, not a percentage. Moving from 10 to 14 makes every login sixteen times slower for your server too, so raise it against measured latency on your own hardware rather than to a number you read somewhere.
- Never put a live password into a web page to be hashed. Hashing belongs on your server, where the plaintext arrives over TLS, is never rendered, and never reaches a log line or a form field.
- Raising the cost factor does not upgrade the hashes you already stored. The cost is baked into each string. The standard migration is to re-hash the next time that user signs in successfully, which is the only moment you legitimately hold the plaintext.
- bcrypt itself ignores everything past the first 72 bytes of a password. Long passphrases silently lose their tail, which matters if you accept them or pre-hash input before bcrypt.
Not the right tool for: Producing the hash you store in production. Generate that inside your application with a maintained library — Argon2id is the current first recommendation in OWASP password storage guidance, with bcrypt at cost 10 or above an accepted alternative.
Frequently Asked Questions
What is password hashing?
Password hashing transforms a password into a fixed-length string (the hash) using a one-way function. Databases store hashes, not plaintext — if the database leaks, attackers can't read the original passwords. Bcrypt is the recommended hashing algorithm because it is deliberately slow, making brute-force attacks impractical.
What is salt in password hashing?
A salt is a random value added to the password before hashing, making every hash unique even for identical passwords. Bcrypt generates a 16-byte random salt automatically and embeds it in the output hash. Without a salt, attackers can use precomputed rainbow tables to crack multiple hashes at once.
Can you decrypt a bcrypt hash?
No — bcrypt is a one-way function with no decryption. To check a password, you run bcrypt on the input with the stored salt and compare the result to the stored hash. If they match, the password is correct. This design means even the application developer cannot retrieve the original password.
How to Use Bcrypt Hash Generator
- Paste or type your input in the input area above.
- The tool processes your input automatically or click Run.
- Copy or download the result using the action buttons.
- Use Ctrl+Enter to run quickly from the keyboard.