bcrypt Hash Generator
Higher is slower to compute but harder to crack.
Hashed in your browser. Your password is never sent to a server.
What is bcrypt Hash Generator
bcrypt is a password hashing function built for one job: safely storing passwords. It is deliberately slow and mixes in a random salt, so two people with the same password get different hashes and an attacker cannot use precomputed tables. This generator turns your password into a bcrypt hash right in your browser, using the modern $2b variant. The cost factor controls how much work each hash takes, and the salt is embedded in the output so you never store it separately.
How to use
- Type or paste the password you want to hash.
- Choose a cost factor. 10 to 12 is a common choice for servers today.
- Click Generate hash and read the 60-character bcrypt hash.
- Copy the hash to store it. To check a password against a hash later, use the bcrypt verifier.
When to use it
Seeding a users table, writing a migration, or testing a login flow and need a real bcrypt hash? Type the password, pick a cost, and copy the $2b hash straight into your database or fixture. Because the salt is baked into the hash, that single string is all you store. When you need to confirm a password matches a stored hash, switch to the bcrypt verifier.
Frequently asked questions
What cost factor should I use?
The cost factor sets how many rounds bcrypt runs, doubling the work with each step. 10 to 12 is common on servers today, balancing security against the time each login takes. Higher is safer but slower, so pick the highest your hardware can afford without annoying users.
Why do I get a different hash every time?
bcrypt generates a fresh random salt for each hash and embeds it in the output. That is by design: identical passwords produce different hashes, which stops attackers from spotting reused passwords or using precomputed tables. Verification still works because the salt travels inside the hash.
Can I turn a bcrypt hash back into the password?
No. bcrypt is a one-way hash, there is no decrypt. To check whether a password matches a hash, re-hash the candidate with the same salt and compare, which is exactly what the bcrypt verifier does.
Which bcrypt variant does it produce?
The modern $2b variant. It is compatible with the $2a and $2y hashes produced by PHP, Node, Python and other bcrypt libraries, so a hash generated here verifies anywhere standard bcrypt is used.
Is my password sent anywhere?
No. The hash is computed entirely in your browser with a self-contained implementation. Your password is never uploaded or stored, which is why this tool has no share link.
Related tools
bcrypt Hash Verifier
Check if a password matches a bcrypt hash online. Works with $2a, $2b and $2y hashes. Compared privately in your browser, nothing uploaded.
AES Text Decryption
Decrypt AES-256 encrypted text with your password in your browser. Free, private, and fully offline. No data leaves your device.
AES Text Encryption
Encrypt text with a password using AES-256 in your browser. Free, private, and fully offline. Nothing is sent to a server.