Hash, verify, compare — all in your browser.
Generate bcrypt hashes with a cost factor from 4 to 14, verify plaintext against an existing hash, or compare bcrypt with SHA-256 and MD5 side by side. Nothing ever leaves your device.
The password you want to hash. It never leaves your browser.
Each increment doubles the work. 2cost iterations. 10–12 is typical for web apps.
Leave empty for a secure random salt. Manual salts are for testing only.
Four steps to a secure bcrypt hash.
No manual required — here's the entire flow.
Pick a mode
Generate a new bcrypt hash from a password, or switch to Verify mode to check a plaintext against an existing hash.
Set your options
Choose a cost factor from 4 to 14. Higher is slower and more secure. Use a random salt or a manual one for testing.
Generate
Tap Generate Hash. Your bcrypt hash appears on the right, with an optional SHA-256 and MD5 comparison below it.
Copy or download
Copy the hash, copy everything, or download as a text file. In Verify mode, you'll see a clear match or no-match result.
Built for real password security.
The details that make a bcrypt generator trustworthy, without ever leaving your browser.
Runs on your device
Every hash is computed locally using JavaScript. Nothing is logged, saved, or sent anywhere — ever.
Full bcrypt control
Adjust the cost factor to balance security and speed. The tool shows the full hash structure so you can see each part.
Verify & compare
Check a plaintext against any bcrypt hash, and see how bcrypt stacks up against faster hashing algorithms.
Questions people actually ask.
The short answers — with the long ones one tap away.
What is bcrypt and why should I use it?+
Bcrypt is a password-hashing function designed to be slow and computationally expensive, which makes brute-force attacks much harder. It automatically generates and stores a salt with each hash, so identical passwords produce different hashes.
What does the cost factor (rounds) mean?+
The cost factor determines how many times the hashing algorithm loops — specifically 2cost iterations. Higher cost means slower hashing and better resistance to brute-force attacks. A cost of 10–12 is a common balance for web applications.
Are my passwords sent to a server?+
No. All hashing and verification happen locally in your browser using JavaScript. Nothing is uploaded, logged, or stored. Closing or refreshing the page clears everything.
Can I verify a password against a bcrypt hash I already have?+
Yes. Switch to the Verify tab, paste the bcrypt hash and the plaintext password, and the tool will tell you if they match. This runs entirely client-side.
What is the difference between bcrypt and SHA-256?+
SHA-256 is a fast cryptographic hash — designed for speed and integrity, not password storage. Bcrypt is intentionally slow and includes a salt, making it far better for storing passwords. This tool lets you compare both side by side.
How long should a bcrypt hash take?+
A good target is 100–500 milliseconds per hash on your target hardware. Too fast and brute-force becomes easier; too slow and your login system suffers. Adjust the cost factor until you hit that range.
Does this tool store or remember any hash I generate?+
No. Nothing is saved, logged, or synced anywhere. Once you leave or refresh the page, every hash is gone for good.
Is this bcrypt generator free to use?+
Yes, it's completely free with no account, no sign-up, and no limit on how many hashes you generate.