Bcrypt Generator & Password Hash Checker
Hash any password with bcrypt (adjustable cost factor) and verify a plaintext password against an existing $2a$/$2b$/$2y$ hash. Includes a random password generator — everything runs locally in your browser, so your password is never sent to a server.
Higher = slower & stronger. 10–12 is recommended.
About bcrypt
- bcrypt is a password-hashing function with a built-in random salt — the same password produces a different hash every time, which is expected.
- The cost factor controls how slow (and brute-force resistant) hashing is; each +1 doubles the work.
- Everything runs locally in your browser — your password is never sent to a server.
- Use Verify to check a plaintext password against an existing $2a$/$2b$/$2y$ hash.
About this tool
The Bcrypt Generator & Password Hash Checker creates bcrypt hashes from a password and verifies whether a plaintext password matches an existing hash. Bcrypt is a deliberately slow, salted hashing algorithm designed for storing passwords: each hash embeds a random salt and a cost factor, so identical passwords still produce different hashes and brute-force attacks stay expensive.
It doubles as a verifier: paste a $2a$, $2b$ or $2y$ hash together with a candidate password to confirm a match, exactly as your login code would. Everything — hashing, salting and comparison — happens locally in your browser, so passwords are never transmitted to any server.
How to use
- Enter the password you want to hash, or use the built-in generator to create a strong random one.
- Pick a cost factor (work factor); higher values are more secure but slower to compute.
- Read the resulting bcrypt hash and copy it for your database or config.
- To verify, switch to the checker, paste an existing hash and the plaintext password to test.
- See an instant match or no-match result confirming whether the password is correct.
Features
- Generate salted bcrypt hashes with an adjustable cost factor.
- Verify a plaintext password against any $2a$/$2b$/$2y$ hash.
- Built-in strong random password generator.
- Automatic per-hash salt so identical passwords differ every time.
- Copy hashes with one click for your app or database.
- Fully client-side — your password never leaves the browser.
Frequently asked questions
Is my password sent anywhere when hashing or verifying?
No. Both hashing and verification run entirely in your browser. Your password and the hash you paste never leave your device.
What cost factor should I choose?
A cost factor between 10 and 12 is a common balance for web apps in 2026. Higher values slow down attackers but also make every login check take longer, so tune it to your hardware.
Why does the same password produce a different hash each time?
Bcrypt generates a new random salt for every hash and embeds it in the output. That is expected and secure — verification still works because the salt is stored inside the hash string.
What do $2a$, $2b$ and $2y$ mean?
They are bcrypt version prefixes from different implementations. They are compatible for verification, and the checker accepts all three formats.
Can I recover the original password from a bcrypt hash?
No. Bcrypt is a one-way hash. You can only verify whether a candidate password matches; the original cannot be recovered from the hash.