Skip to content
XUtilHub

Bcrypt Hash Generator & Checker

Generate bcrypt password hashes with a chosen cost factor and verify a password against an existing bcrypt hash, entirely in your browser.

  • Free, no sign-up
  • Runs in your browser, nothing uploaded

About the Bcrypt Generator

Create bcrypt hashes for passwords with your chosen cost factor, or check whether a password matches a bcrypt hash. Hashing runs locally, so passwords never leave your device.

Key features

  • Generate bcrypt hashes
  • Verify a password against a hash
  • Cost factor from 4 to 14
  • Random salt for every hash
  • Warns about the 72-byte limit
  • Private: passwords never leave your browser

Hash and check passwords with bcrypt

Generate a bcrypt hash to seed a test user, check whether a password matches a hash from your database, or see how long different cost factors take on your device. Everything runs locally in your browser.

Anatomy of a bcrypt hash

$2b$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy
 └┬┘└┬┘└──────────┬─────────┘└──────────────┬──────────────┘
version cost   22-character salt        31-character hash

Cost factor and speed

CostRelative work
101× (1,024 rounds)
112×
124×
138×
1416×

Good practice

  • Never store plain passwords or fast hashes such as MD5 or SHA-256 for passwords.
  • Don't use real production passwords in online tools, even ones that run locally like this.
  • Consider Argon2id for new systems; it's the winner of the Password Hashing Competition. bcrypt is still a solid, widely supported choice.

Password generator, hash generator, and UUID generator.

How to use the Bcrypt Generator

  1. Enter your value in the fields above, or start from one of the examples or presets.
  2. Results update instantly as you type.
  3. Read the breakdown to understand each part of the result.
  4. Copy what you need with the copy buttons. Everything runs in your browser.

Frequently asked questions

What is bcrypt?

A password-hashing function designed to be slow, which makes guessing passwords from a stolen database expensive. It's built into most web frameworks, including Laravel, Django, Rails and Spring Security.

Which cost factor should I use?

Choose the highest cost your server can handle while keeping logins fast, often 10–12. Each step doubles the time. Aim for roughly 100–300 ms per hash on your production hardware.

Why is the hash different every time?

bcrypt generates a random salt for each hash and stores it inside the hash. That's why the same password gives different hashes, and why you verify a password with a compare function instead of hashing it again and comparing strings.

What do $2a$, $2b$ and $2y$ mean?

They're version prefixes. $2b$ is the current standard; $2y$ comes from PHP and is equivalent. The number after it (e.g. $10$) is the cost factor.

Is my code uploaded anywhere?

No. Every developer tool runs entirely in your browser, so source code, configuration files and passwords never leave your device.

Which formatter do you use?

HTML, CSS and JavaScript are formatted with Prettier, the most widely used code formatter, so the output matches what most projects use. SQL uses sql-formatter, and minification uses Terser and CSSO.

Is there a size limit?

There's no fixed limit. Very large files (several megabytes) can take a few seconds, depending on your device.

Last updated:

Related Dev tools