Cómo usar: Bcrypt Generator & Checker
- Enter a password and choose a cost factor (10–12 is typical).
- Click Generate hash; every run produces a different hash because the salt is random.
- To check a password, paste it and the stored hash under Verify a password.
What is bcrypt?
Bcrypt is a password-hashing function designed in 1999 to be deliberately slow. Each hash includes a random 128-bit salt and a cost factor: the work grows as 2cost, so you can make hashing slower as hardware gets faster. That makes brute-forcing stolen hashes far more expensive than with fast hashes like MD5 or SHA-256, which should never be used for passwords on their own.
Anatomy of a bcrypt hash
$2b$12$R9h/cIPz0gi.URNNX3kh2OPST9/PgBkqquzi.Ss7KIUgO2t0jWMUW
│ │ └ 22-char salt └ 31-char hash$2b$ is the algorithm version and 12 the cost. $2a$, $2b$ and $2y$ produce identical hashes for normal passwords; $2y$ is the name PHP and Apache use, $2b$ the current OpenBSD standard.
Choosing the cost factor
| Cost | Iterations | Use |
|---|---|---|
| 4–8 | 16–256 | Unit tests only |
| 10 | 1,024 | Common default (Laravel, Node bcrypt) |
| 12 | 4,096 | Good choice on current servers (~250 ms) |
| 14+ | 16,384+ | Very slow; can hurt login performance |
Aim for 100–500 ms per hash on your production hardware. The time shown above is measured in your browser and only an indication.
Bcrypt cannot be “decrypted”
Bcrypt is one-way: there is no key that turns a hash back into a password. Verifying works by hashing the candidate password with the salt and cost stored in the hash and comparing the results — which is exactly what the checker does. Note that bcrypt ignores everything after the first 72 bytes of a password.
For HTTP Basic Auth files, use the htpasswd generator; to create strong passwords, use the password generator.
También se busca como: bcrypt hash generator, bcrypt online, bcrypt verify, bcrypt checker, hash password bcrypt, bcrypt decrypt, $2y$ hash.
Herramientas que combinan con: Bcrypt Generator & Checker
- Hash Generator — Compute MD5 and SHA hashes of any text or file instantly, create HMAC signatures, and paste an expected checksum to verify a download.
- HMAC Generator — Compute keyed HMAC signatures for API requests and webhooks, and check whether a received signature is valid — using your browser’s Web Crypto API.
- Comprobador de seguridad de contraseñas — Escribe una contraseña para ver cuántas combinaciones posibles tiene, cuánto tiempo se tardaría en descifrarla, qué patrones la hacen más vulnerable y, si quieres, si aparece en filtraciones de datos conocidas.
- Decodificador JWT — Pega un token web JSON para examinar su encabezado y su carga útil, comprobar cuándo caduca y verificar su firma.
Preguntas frecuentes
Can you decrypt a bcrypt hash?
Why is the hash different every time?
Are $2a$, $2b$ and $2y$ compatible?
password_verify accepts all three.