Home › Generators › Bcrypt Generator
Bcrypt Generator
This free bcrypt generator turns a password into a secure bcrypt hash — the same kind of hash used to store passwords in real applications — and it can also verify a password against a hash you already have. Pick a cost factor from 4 to 12, press Generate Hash, and get a 60-character hash starting with $2a$. Everything runs in your browser: your password is never sent to a server, never stored, and never leaves your device.
Your password never leaves this page — hashing runs entirely in your browser.
How it works
Storing a password as plain text is never acceptable: anyone who reads the database reads every password. Storing a fast hash like MD5 or SHA-256 is barely better, because those hashes are designed to be quick — an attacker with a stolen database can try billions of guesses per second on ordinary hardware. Bcrypt was designed for the opposite job. It is deliberately slow, it is adaptive, and it salts every password, which together make guessing attacks expensive even with powerful hardware. That is why bcrypt has been the standard choice for password storage for more than twenty years.
Salting is the first half of the protection. A salt is a random string, 16 bytes long, generated fresh for every single password. Bcrypt mixes the salt into the hash, so two users with the same password — "hello123", say — end up with completely different hashes. Without a salt, an attacker could precompute the hash of every common password once and compare the whole database against that list in seconds; that precomputed list is called a rainbow table, and salting makes it useless, because every password has to be attacked individually. The salt is stored inside the hash itself, in the first 29 characters, so verification needs nothing but the hash — there is no separate salt to keep track of.
The cost factor is the second half. It sets how many rounds of work bcrypt performs: the work doubles with each step, so cost 10 does 1,024 rounds (2 to the power of 10), cost 11 does 2,048, and cost 12 does 4,096. On a typical computer, cost 10 takes roughly a tenth of a second — unnoticeable when one user logs in, but devastating to an attacker who must pay that tenth of a second for every single guess. Cost 4 is fast and only suitable for testing; cost 12 is stronger but noticeably slower. Cost 10 is the long-standing default, and this tool uses it unless you choose otherwise. Because computers get faster every year, the right cost creeps upward over time — that is the "adaptive" part of bcrypt: raise the cost and old hashes stay valid, since the cost is recorded in the hash.
A bcrypt hash is always 60 characters long and always starts with $2a$, followed by the two-digit cost, a $, then 22 characters of salt and 31 characters of hash, all in a special base-64 alphabet. You can read a hash at a glance: $2a$10$ at the start means bcrypt, version 2a, cost 10. Verification works by hashing the password the user just typed with the same salt and cost taken from the stored hash, and comparing the result — the tool's Verify mode does exactly that. If the two match, the password is correct; if not, it is wrong. The comparison is done in a way that takes the same time either way, so an attacker cannot learn anything from how fast a wrong guess is rejected.
One warning that matters more than any setting: bcrypt protects a password, but it cannot rescue a weak one. "password123" hashed with cost 12 is still "password123", and it will still be one of the first guesses any attacker tries. Use a long, unique password — or better, a passphrase of four or five random words — and a password manager to remember it. And never reuse a password across sites: a breach anywhere exposes the password everywhere it was reused, no matter how it was hashed.
Worked example
A developer is building a login page and needs a bcrypt hash of the test password "hello123" at the default cost, to check that the login code verifies it correctly.
Step 1: Type hello123 into the Password field.
Step 2: Leave the cost factor on 10 — recommended default.
Step 3: Press Generate Hash.
The tool returns a 60-character hash starting with $2a$10$, followed by 22 characters of random salt and 31 characters of hash — the exact salt is random, so the hash is different every time you press the button, even for the same password. The developer copies the hash into the test database, then switches to Verify mode, enters "hello123" and the hash, and gets a match. Entering "hello124" instead gives no match, confirming the check works.
FAQ
What is bcrypt?
Bcrypt is a password-hashing algorithm designed to be slow and salted. It turns a password into a fixed 60-character hash, and it is deliberately expensive to compute, so guessing attacks are slow even on fast hardware. It has been the standard choice for storing passwords for more than twenty years.
Why does the same password give a different hash every time?
Because bcrypt generates a fresh random salt for every hash. The salt is mixed into the result, so the same password with two different salts produces two completely different hashes. That is by design — it stops attackers from precomputing hashes of common passwords.
What cost factor should I choose?
Cost 10 is the recommended default and a good balance: about a tenth of a second per hash on a typical computer. Use cost 4 only for testing, where speed matters more than security. Use cost 12 when you want stronger protection and can afford the slower login. Each step up doubles the work.
How do I read a bcrypt hash?
A bcrypt hash is always 60 characters. It starts with $2a$, then the two-digit cost, then a $, then 22 characters of salt and 31 characters of hash. So $2a$10$ at the start means bcrypt, version 2a, cost factor 10.
Is my password sent to a server?
No. Hashing and verification both run entirely in your browser using a local copy of the bcrypt library. Your password never leaves this page, is never uploaded, and is never stored anywhere.