About the Bcrypt Generator and Checker
Bcrypt Generator and Checker creates and tests bcrypt hashes, the slow, salted format widely used to store passwords. To make a hash, type a password, choose a cost from 4 to 14 and press Make hash: you get the 60-character hash starting with $2b$ that you can put in a database, a config file or a test. To check, paste a hash and a password and the tool tells you whether they match, and it shows the version, cost and salt it read from the hash. A new random salt is used every time, so the same password gives different hashes that all verify. It helps developers test logins, seed databases and debug hashes. The work is done in your browser, and nothing you type is uploaded.
Updated September 2026
How to use the Bcrypt Generator and Checker
- 1Choose Make a hash or Check a password.
- 2Type the password or text. Tick Show the text if you want to see it.
- 3To make a hash, set the cost with the slider and press Make hash, then copy the result.
- 4To check, paste the bcrypt hash and press Check password.
- 5Read the match result. The tool also shows the version, cost and salt in the hash.
Why bcrypt is used for passwords
Storing passwords as plain text is dangerous, and storing them with a fast hash is little better, because modern graphics cards can test billions of guesses a second. Bcrypt was made to be slow on purpose. It also uses a salt, a random value stored with the hash, so two users with the same password get different hashes and pre-computed tables are useless.
Its cost setting lets the work grow as computers get faster. Raise the cost over time and re-hash passwords when users log in.
Making a hash
- Type a test password and choose a cost. Ten is a sensible starting point.
- Press Make hash. The result is 60 characters long and starts with $2b$.
- Copy it into your database, fixture or configuration file.
- Make another hash for the same password to see how the salt changes the result.
Checking a password against a hash
Paste a hash from your database and type a password to test. The tool repeats the bcrypt calculation using the salt and cost in the hash and tells you whether the result is the same. This is useful when you need to find out whether an account uses a known test password or when a login fails and you want to see whether the stored hash is the problem.
If the hash is not accepted, check that it is complete, has no extra spaces and starts with $2a$, $2b$ or $2y$. Hashes from some systems use the $2y$ or $2a$ prefix, which are compatible in practice.
Good practice and related tools
Use a well-tested library on your server, use a unique salt for every password and never log or send raw passwords. Password Generator makes strong passwords, Password Strength Checker rates them, Hash Generator produces fast hashes such as SHA-256 for files and checksums, and Base64 Encoder and Decoder helps when a hash needs to travel in text.
Features
- Hash generator with cost from 4 to 14
- Password checker for any bcrypt hash
- Shows version, cost and salt of a hash
- New random salt for every hash
- Warning for passwords over 72 bytes
- Show or hide the typed text
- Copy the hash in one tap
- Runs in your browser, nothing is uploaded
Frequently asked questions
What is bcrypt?
Bcrypt is a password hashing function designed to be slow. It mixes in a random salt so equal passwords give different hashes, and it has a cost setting that makes each guess more expensive. That makes it much harder for an attacker to try billions of guesses than with a fast hash such as MD5 or SHA-256.
What cost should I choose?
Pick the highest cost your server can handle without making logins feel slow. Values of 10 to 12 are common today. Each increase of one doubles the work. The best choice is one that takes roughly a quarter to half a second on your production hardware.
Why do I get a different hash every time for the same password?
Each hash includes a fresh random 22-character salt. The salt is stored inside the hash string, so the checker can read it back and repeat the calculation. All the different hashes will verify against the same password.
What do the parts of a bcrypt hash mean?
A hash looks like $2b$10$ followed by 53 characters. The 2b is the version, 10 is the cost, the next 22 characters are the salt and the last 31 are the hash of the password. The tool shows these parts when you paste a hash to check.
Is there a password length limit?
Yes. Bcrypt uses only the first 72 bytes of a password, so anything after that is ignored. Non-English letters take more than one byte each. The tool warns you when your text is longer than 72 bytes.
Can bcrypt be reversed to find the password?
No. Hashing is one way. The only way to find a password is to guess it, hash the guess and compare, which is why the slow cost and a strong password matter. That is exactly what the checker does with your one guess.
Is it safe to type a real password here?
The work happens in your browser and nothing is sent to us, but it is good practice not to type important, real passwords into any website. Use test passwords to generate hashes for development, and hash real passwords in your own application.