Each step doubles the work. 10–12 is the common range; higher is slower but stronger.
Bcrypt hash
Bcrypt Hash Generator
Hash and verify passwords with bcrypt.
About the Bcrypt Hash Generator
What is a bcrypt hash?
Bcrypt is a password-hashing function designed specifically for storing passwords safely. Unlike fast hashes such as MD5 or SHA-256, bcrypt is deliberately slow and includes a built-in salt, which makes large-scale password cracking impractical. Its output is a self-contained string like $2y$10$... that packs the algorithm, the cost, the salt and the hash into one value.
The key idea is the cost factor: each increment doubles the work needed to compute the hash, so you can dial the difficulty up as computers get faster, without changing anything else. Bcrypt has protected passwords since 1999 and remains a solid, widely supported choice. This tool generates and verifies bcrypt hashes entirely in your browser, so no password is ever transmitted.
How to Use This Tool
- Enter the password. Type or paste the password you want to hash.
- Adjust the settings. Set the cost factor; the hash recomputes automatically.
- Copy the result. One click copies the hash to your clipboard.
- Verify existing hashes. Switch to the Verify tab to check a password against a stored hash.
Common Use Cases
- Storing user passwords: hash a password before saving it, and never store the plain text.
- Verifying a login: use the Verify tab to check a submitted password against a stored bcrypt hash.
- Matching PHP, Node or Laravel: bcrypt output here is compatible with those ecosystems' password functions.
- Tuning the cost: benchmark different cost factors to find one that is comfortably slow on your server.
Frequently Asked Questions
Is bcrypt still secure in 2026?
Yes. Bcrypt remains a solid choice for password hashing. Modern guidance often prefers Argon2id for new projects, but a bcrypt hash with a cost factor of 10 to 12 is perfectly acceptable and is still the default in many frameworks. What matters most is using a slow, salted password hash rather than a bare SHA-256.
What cost factor should I use?
Pick the highest value your server can tolerate without slowing logins noticeably, commonly 10 to 12. Each step doubles the time, so cost 12 is four times slower than cost 10. Aim for roughly 250 milliseconds per hash on your hardware; use the timing readout here as a rough guide.
Why does bcrypt include the salt in the hash?
The salt is stored as part of the output string so you do not have to manage it separately. When verifying, bcrypt reads the salt and cost straight from the stored hash, recomputes, and compares. That is why a single self-contained string is all you need to keep.
What is the difference between $2a$, $2b$ and $2y$?
They are version prefixes for the same bcrypt algorithm. $2y$ is what PHP produces, $2b$ is the current OpenBSD version, and $2a$ is older. They are interchangeable for verification, so a hash made here verifies against PHP, Node and other libraries.
Does bcrypt have a password length limit?
Yes, bcrypt only uses the first 72 bytes of the password; anything beyond that is ignored. This is rarely a problem in practice, but if you need to hash very long inputs, pre-hash them with SHA-256 first or use Argon2, which has no such limit.
Is it safe to generate a hash here?
Yes. The hashing and verification run entirely in your browser using a vendored bcrypt library. Your password and the resulting hash are never sent to our servers or stored anywhere.