Bcrypt Generator & Verifier
Generate salted bcrypt password hashes and verify a password against an existing bcrypt hash, in your browser.
Bcrypt is a slow, salted password-hashing algorithm. A higher cost is more secure but slower. All hashing runs in your browser.
What Is the Bcrypt Generator & Verifier?
The Bcrypt Generator creates secure, salted bcrypt password hashes and can verify whether a password matches an existing hash. Bcrypt is the industry standard for storing passwords because it is deliberately slow and includes a per-hash salt, which makes brute-force and rainbow-table attacks far harder. Hashing runs entirely in your browser.
How It Works
In Generate mode, enter a password, choose a cost (work factor) and click Generate — a unique $2a$ hash is produced, different every time thanks to the random salt. In Verify mode, paste an existing bcrypt hash and the candidate password to check whether they match.
When to Use It
Use it to generate test password hashes for development and seeding databases, to confirm your application produces valid bcrypt hashes, or to verify a stored hash against a password during debugging. Choose a higher cost for production-grade security.
Frequently Asked Questions
- Why does the same password produce a different hash each time?
- Bcrypt embeds a random salt in every hash, so the output differs each run. Verification still works because the salt is stored inside the hash itself.
- What cost (rounds) should I use?
- A cost of 10–12 is a good default for most applications. Higher is more secure but slower; pick the highest value your servers can handle within an acceptable login time.
- Is my password sent anywhere?
- No. The bcrypt library runs locally in your browser, so passwords and hashes never leave your device.
Last reviewed: 2026-06-27