Como usar: Bcrypt Generator & Checker
- Enter a password and choose a cost factor (10–12 is typical).
- Click Generate hash; every run produces a different hash because the salt is random.
- To check a password, paste it and the stored hash under Verify a password.
What is bcrypt?
Bcrypt is a password-hashing function designed in 1999 to be deliberately slow. Each hash includes a random 128-bit salt and a cost factor: the work grows as 2cost, so you can make hashing slower as hardware gets faster. That makes brute-forcing stolen hashes far more expensive than with fast hashes like MD5 or SHA-256, which should never be used for passwords on their own.
Anatomy of a bcrypt hash
$2b$12$R9h/cIPz0gi.URNNX3kh2OPST9/PgBkqquzi.Ss7KIUgO2t0jWMUW
│ │ └ 22-char salt └ 31-char hash$2b$ is the algorithm version and 12 the cost. $2a$, $2b$ and $2y$ produce identical hashes for normal passwords; $2y$ is the name PHP and Apache use, $2b$ the current OpenBSD standard.
Choosing the cost factor
| Cost | Iterations | Use |
|---|---|---|
| 4–8 | 16–256 | Unit tests only |
| 10 | 1,024 | Common default (Laravel, Node bcrypt) |
| 12 | 4,096 | Good choice on current servers (~250 ms) |
| 14+ | 16,384+ | Very slow; can hurt login performance |
Aim for 100–500 ms per hash on your production hardware. The time shown above is measured in your browser and only an indication.
Bcrypt cannot be “decrypted”
Bcrypt is one-way: there is no key that turns a hash back into a password. Verifying works by hashing the candidate password with the salt and cost stored in the hash and comparing the results — which is exactly what the checker does. Note that bcrypt ignores everything after the first 72 bytes of a password.
For HTTP Basic Auth files, use the htpasswd generator; to create strong passwords, use the password generator.
Também pesquisado como: bcrypt hash generator, bcrypt online, bcrypt verify, bcrypt checker, hash password bcrypt, bcrypt decrypt, $2y$ hash.
Ferramentas que combinam com: Bcrypt Generator & Checker
- Hash Generator — Compute MD5 and SHA hashes of any text or file instantly, create HMAC signatures, and paste an expected checksum to verify a download.
- HMAC Generator — Compute keyed HMAC signatures for API requests and webhooks, and check whether a received signature is valid — using your browser’s Web Crypto API.
- Verificador de força da senha — Digite uma senha para ver quantas combinações possíveis ela tem, quanto tempo levaria para ser quebrada, quais padrões a tornam mais fraca — e, se quiser, se ela aparece em vazamentos de dados conhecidos.
- Decodificador JWT — Cole um JSON Web Token para analisar seu cabeçalho e sua carga, verificar quando ele expira e conferir sua assinatura.
Perguntas frequentes
Can you decrypt a bcrypt hash?
Why is the hash different every time?
Are $2a$, $2b$ and $2y$ compatible?
password_verify accepts all three.