Bcrypt Generator
Hash and verify passwords with bcrypt and an adjustable cost factor
About Bcrypt Generator
Hashes passwords with bcrypt at a cost factor from 4 to 15, times each run and splits any hash into its $2a$, $2b$ or $2y$ prefix, cost, 22-character salt and 31-character checksum. Verify mode checks a password against an existing hash client-side, with a warning when input exceeds bcrypt's 72-byte limit. Handy for seeding user tables, testing login code or debugging stored hashes.
Category: Generators.
Frequently asked questions
What cost factor should I use?
▾
Choose the highest cost your servers can afford at roughly 100 to 300 ms per hash; 10 to 12 is common today. Each +1 doubles the work, and after a run the tool estimates the time at other costs, but bcryptjs in the browser is usually slower than native server libraries, so treat it as a rough guide.
Why does the same password produce a different hash every time?
▾
Each hash gets a fresh 128-bit random salt, stored in the 22 characters after the cost. Verification reads the salt and cost back out of the hash, so every one of those hashes still matches the password.
What is the difference between $2a$, $2b$ and $2y$?
▾
$2a$ is the original format, $2b$ is the current OpenBSD one and $2y$ is what PHP's password_hash emits. In bcryptjs, which runs this page, all three use the same algorithm and checksum, so pick whichever prefix your framework expects; $2x$, a legacy crypt_blowfish bug-compatibility mode, is rejected.
Why is there a warning for passwords longer than 72 bytes?
▾
bcrypt only uses the first 72 bytes of the UTF-8 encoded password, so passwords that share those bytes produce matching hashes. Accented letters take 2 bytes and emoji 4, so the limit can arrive well before 72 characters; the byte counter and warning show exactly which part is ignored.