Skip to content
ToolMug

Use ↑ ↓ to move, Enter to open, Esc to close.

Bcrypt Generator and Checker

Create a bcrypt hash for a password, or check whether a password matches an existing bcrypt hash — useful when debugging logins or seeding an admin password. Everything is computed in your browser; the password is never sent to a server.

Runs in your browser — nothing you enter is uploaded

Generate a hash

10

Each step doubles the work. 10–12 is typical for logins today.

Check a password against a hash

How to use

  1. Under Generate a hash, type the password, set the cost factor with the slider and click Generate hash.
  2. Copy the hash. Each hash uses a new random salt, so the same password gives a different hash every time.
  3. To check a password, paste the bcrypt hash on the right and type the password. The result shows whether they match.

Options explained

Cost factor
4 to 15, default 10. The work is 2 to the power of the cost, so each step doubles the time. The page shows how long the hash took in your browser as a guide.
Version prefix
New hashes start with $2b$. For checking, $2a$, $2b$ and the $2y$ hashes made by PHP password_hash all work as they are.
72-byte limit
bcrypt only uses the first 72 bytes of a password (UTF-8, so some characters take 2–4 bytes). The page warns you when a password is longer; the rest is ignored.

Anatomy of a hash

$2b$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy

Frequently asked questions

Why does the same password give a different hash each time?

bcrypt generates a random 16-byte salt for every hash and stores it inside the hash (the 22 characters after the cost). Checking takes the salt from the hash and recomputes, so all of those hashes verify.

Can bcrypt be decrypted?

No. bcrypt is a one-way hash; the only way to check a password is to hash a candidate and compare. Sites offering to "decrypt" bcrypt are just trying common passwords one by one.

What cost factor should I use?

A common rule is to make one hash take about 100 ms on your server, which today usually means 10–12. Too low makes brute force easier; too high slows logins and loads the server.

How is it different from MD5 or SHA-256?

MD5 and SHA-256 are designed to be fast — a single GPU can try billions per second — so they are unsuitable for storing passwords on their own. bcrypt is deliberately slow and has a built-in salt; it was designed for password storage.

Is my password uploaded?

No. Hashing and checking run in JavaScript in your browser and work offline.

Privacy

This tool runs entirely in your browser. Your files and text are processed on your device and are never uploaded to our servers.

Related tools