How to use the Bcrypt Generator & Checker
- Enter a password and choose a cost factor (10–12 is typical).
- Click Generate hash; every run produces a different hash because the salt is random.
- To check a password, paste it and the stored hash under Verify a password.
What is bcrypt?
Bcrypt is a password-hashing function designed in 1999 to be deliberately slow. Each hash includes a random 128-bit salt and a cost factor: the work grows as 2cost, so you can make hashing slower as hardware gets faster. That makes brute-forcing stolen hashes far more expensive than with fast hashes like MD5 or SHA-256, which should never be used for passwords on their own.
Anatomy of a bcrypt hash
$2b$12$R9h/cIPz0gi.URNNX3kh2OPST9/PgBkqquzi.Ss7KIUgO2t0jWMUW
│ │ └ 22-char salt └ 31-char hash$2b$ is the algorithm version and 12 the cost. $2a$, $2b$ and $2y$ produce identical hashes for normal passwords; $2y$ is the name PHP and Apache use, $2b$ the current OpenBSD standard.
Choosing the cost factor
| Cost | Iterations | Use |
|---|---|---|
| 4–8 | 16–256 | Unit tests only |
| 10 | 1,024 | Common default (Laravel, Node bcrypt) |
| 12 | 4,096 | Good choice on current servers (~250 ms) |
| 14+ | 16,384+ | Very slow; can hurt login performance |
Aim for 100–500 ms per hash on your production hardware. The time shown above is measured in your browser and only an indication.
Bcrypt cannot be “decrypted”
Bcrypt is one-way: there is no key that turns a hash back into a password. Verifying works by hashing the candidate password with the salt and cost stored in the hash and comparing the results — which is exactly what the checker does. Note that bcrypt ignores everything after the first 72 bytes of a password.
For HTTP Basic Auth files, use the htpasswd generator; to create strong passwords, use the password generator.
Tools that pair well with the Bcrypt Generator & Checker
- HMAC Generator — Compute keyed HMAC signatures for API requests and webhooks, and check whether a received signature is valid — using your browser’s Web Crypto API.
- Password Strength Checker — Type a password to see how many possible combinations it has, how long it would take to crack, which patterns make it weaker — and, if you like, whether it appears in known data breaches.
- JWT Decoder — Paste a JSON Web Token to inspect its header and payload, check when it expires and verify its signature.
- JWT Encoder — Build a JWT for testing APIs: edit the payload, add standard claims with one click and sign it with an HMAC secret or an RSA / EC private key.
Frequently asked questions
Can you decrypt a bcrypt hash?
Why is the hash different every time?
Are $2a$, $2b$ and $2y$ compatible?
password_verify accepts all three.