Bcrypt Generator
Hash passwords with the bcrypt algorithm — the industry-standard for secure password storage.
Paste a hash from the history or type one manually.
Match! No Match
The hash matches your input.
Verified in
What is bcrypt?
Bcrypt is an adaptive hashing algorithm designed for passwords. Its "cost factor" deliberately slows down brute-force attacks — making stolen hashes exponentially harder to crack.
Industry Standard
Bcrypt has been the gold standard for password hashing since 1999. It is used by frameworks like Django, Laravel, Rails, and Spring Security, and is recommended by OWASP.
100% Browser-Based
All hashing runs entirely in your browser using bcryptjs. No data is transmitted to our servers — your passwords never leave your device.
Frequently Asked Questions
Everything you need to know about bcrypt and password hashing
Bcrypt is a password hashing function designed by Niels Provos and David Mazières in 1999. Unlike MD5 or SHA, bcrypt is intentionally slow and computationally expensive, making brute-force attacks impractical. It also incorporates a salt automatically, preventing rainbow table attacks. OWASP recommends bcrypt as one of the top choices for password storage.
The cost factor (salt rounds) determines how many times bcrypt iterates its key setup — specifically 2^N iterations. A cost of 12 means 4,096 rounds. Increasing the cost by 1 doubles the computation time. The recommended default is 12 for most applications; higher values (13–14) are appropriate for high-security scenarios where you can afford longer response times.
No. Bcrypt is a one-way hashing function — it cannot be reversed or decrypted. The only way to check if a password matches a hash is to run the same bcrypt algorithm on the input and compare the result. This is exactly what the "Verify" tab of this tool does.
That is by design. MD5 and SHA are designed to be fast — which makes them terrible for passwords (billions of hashes per second on modern GPUs). Bcrypt's deliberate slowness means an attacker who steals your database would need years to brute-force even common passwords. At a cost factor of 12, each guess takes ~400ms on modern hardware.
Yes. This tool uses bcryptjs, a pure JavaScript implementation that runs entirely in your browser. Nothing is sent to our servers. However, for production systems, we still recommend using bcrypt through your server-side framework (Node.js, PHP, Python, etc.) rather than client-side JavaScript.