Bcrypt Generator & Verifier
Generate a bcrypt password hash with your own cost factor and salt, or check a password against an existing hash.
0 bytes
Cost 10 — 1,024 key-setup rounds
crypto.getRandomValues(). Enter a password to hash it.
— - Prefix
- —
- Cost
- —
- Salt
- —
- Digest
- —
Paste a hash and type the password to check it.
How it works
Bcrypt is a password hashing function built on the Blowfish block cipher. It is deliberately
slow: the cost factor you choose is a power of two, so cost 10 runs 210 =
1,024 rounds of an "expensive key schedule" before the string
OrpheanBeholderScryDoubt is encrypted 64 times to produce the 23-byte digest.
Every extra step on the cost slider doubles the work an attacker has to do — and doubles how
long this page takes too. The 16-byte random salt is stored inside the hash, which is why two
hashes of the same password never look alike.
This page implements the standard OpenBSD bcrypt algorithm (the same one behind
bcrypt.hashpw, PHP's password_hash and Node's bcrypt
package) in plain JavaScript, and its output is checked against the published OpenBSD test
vectors. The Blowfish P-array and S-boxes are the standard constants derived from the
hexadecimal digits of π. Salts come from the browser's cryptographic random generator via
crypto.getRandomValues(). Web Crypto has no bcrypt primitive, so the Blowfish
core has to be JavaScript — but nothing about it is home-made: it is the published algorithm,
unchanged.
Nothing is transmitted. No password, salt or hash ever leaves your browser —
there is no server, no API and no logging. Even so, treat any password you type into any web
page as potentially exposed: use this tool for test fixtures, seeding a database, debugging a
login, or checking a hash from your own application, rather than for a live production
credential. Bcrypt only reads the first 72 bytes of a password, and the resulting
$2a$, $2b$ and $2y$ hashes are identical for any
password within that limit — the prefix is a compatibility label, not a different algorithm.
Frequently asked questions
Is my password sent anywhere?
No. The bcrypt algorithm runs in this page's own JavaScript, so your password, the salt and the resulting hash never leave your browser — there is no server, no API call and no logging. That said, treat anything you type into any web page as potentially exposed: this tool is meant for test fixtures, seeding a database, debugging a login or checking a hash from your own application, not for a live production credential.
What does the bcrypt cost factor actually do?
The cost (or work factor) is a power of two: cost 10 means 2^10 = 1,024 rounds of bcrypt's expensive key schedule run before the digest is produced. Every step up the slider doubles the time to compute one hash, which doubles the cost of an offline cracking attempt. Cost 10 to 12 is the usual recommendation for server-side use today. Higher costs are slower here too, because your browser has to do exactly the same work a server would.
What is the difference between $2a$, $2b$ and $2y$ hashes?
They are version prefixes, not different algorithms. $2a$ is the long-standing OpenBSD format, $2y$ was introduced by PHP after a bug in one implementation, and $2b$ is the current OpenBSD default. For any password up to bcrypt's 72-byte limit all three produce byte-identical digests, so a hash generated here will verify in whichever library you use. Bcrypt ignores anything past the first 72 bytes of a password — this page warns you when you cross that line.