Bcrypt Hash Generator

Bcrypt is a password hashing function designed by Niels Provos and David Mazières, based on the Blowfish cipher. It incorporates a salt to protect against rainbow table attacks and is adaptive: over time, the iteration count (cost factor) can be increased to remain resistant to brute-force attacks.

A salt is a random data added to the password before hashing. It ensures that even identical passwords produce different hashes, effectively preventing precomputed rainbow table attacks. Bcrypt automatically generates a unique 128-bit salt for each hash, stored inside the hash string itself.

The cost factor (or "work factor") determines how many times the hashing algorithm is iterated. It is an exponential scale: a cost of 10 means 2¹⁰ (1,024) iterations, while 12 is 2¹² (4,096). Higher values slow down the hash calculation, making brute-force attacks harder. The recommended minimum today is 10 or 12; many applications use 12–14. The maximum practical limit depends on your server’s performance, but this tool allows up to 31.

Yes. All hashing is performed locally in your browser using JavaScript. Your passwords never leave your device and are not transmitted to any server. Always verify the page’s security (HTTPS) and be cautious when using public computers.

They indicate the algorithm version and minor compatibility tweaks:

• $2a$ – Original bcrypt (common).
• $2b$ – Fixed a bug related to 8-bit character handling (used in OpenBSD).
• $2y$ – Adaptation for PHP’s bcrypt implementation before they unified to $2b$.

All are functionally equivalent for most applications.

Store the entire hash string (60 characters long) in a column like VARCHAR(255). When verifying a login attempt, retrieve the stored hash and use bcrypt’s compare function — never decrypt the hash (it’s one-way). Bcrypt libraries exist for nearly all programming languages.