Bcrypt Hash Generator & Checker

Bcrypt is a password hashing function designed in 1999 by Niels Provos and David Mazières, based on the Blowfish cipher. It is deliberately slow and includes a random 128-bit salt in every hash, so identical passwords produce different hashes and precomputed rainbow tables are useless. It remains the default password hasher in Laravel, Ruby on Rails, Spring Security and many other frameworks.

A bcrypt hash such as $2y$10$N9qo8uLOickgx2ZMRZoMye... is self-describing: the version prefix, the two-digit cost, a 22-character salt and a 31-character checksum, all in bcrypt's own Base64 alphabet. Because the salt and cost are stored in the hash, a verifier only needs the password and the hash string.

The cost factor is a base-2 logarithm: cost 10 means 2¹⁰ = 1,024 rounds of key expansion, and every increment doubles the time. OWASP recommends a minimum of 10; pick the highest value that keeps login acceptably fast on your server, typically around 100–300 ms. The prefixes $2a$, $2b$ and $2y$ produce the same result for normal passwords. $2y$ is what PHP emits and $2b$ is the current OpenBSD revision; this checker accepts all three.

Bcrypt only uses the first 72 bytes of a password, so very long passphrases (or multi-byte characters) beyond that limit are silently truncated. All hashing on this page runs in your browser with the bcrypt.js library. For production systems, always hash on the server with a native implementation, and never reuse real user passwords in online tools.

When to use the verifier: debugging a login that fails after a database restore or migration, checking that users imported from another framework still authenticate, or confirming that seed data in staging uses the expected cost factor. Use synthetic test passwords, which you can create with the password generator.

Bcrypt is only for passwords. For file checksums use the hash generator (SHA-256), and for API or webhook signatures use the HMAC generator. Bcrypt is far too slow for those jobs and its random salt makes the output different every time.