Bcrypt Generator online: generate and verify hashes

bcrypt is a deliberately computationally intensive password-hashing algorithm based on the Blowfish cipher. Encryption can be reversed with the right key; a hash cannot. Applications store only the hash and check a password by hashing it again. Fast hashes such as SHA-256 are intended for checksums; passwords need slower algorithms such as bcrypt or Argon2id.

A 60-character bcrypt hash. For the plaintext zap-hosting with cost factor 12, it might look like this: $2b$12$hr8ClvGGH01FXNQBc4g7uurz4HpChG/mbHCsyXJtzOdLgNChQX/zy. It starts with version $2b$, followed by the cost factor, a 22-character salt, and a 31-character hash value. Because a new salt is generated each time, even the same text produces a different hash on every run, but verification with “Verify hash” still works.

Paste the hash into the “Verify hash” section, enter the original text and click “Verify hash”. The result is “Match”, “No match” or “Invalid bcrypt hash format”. The tool recognizes hashes with the prefixes $2a$, $2b$ and $2y$, including $2y$ hashes from PHP. A cost factor outside 4 to 31 is considered invalid. The tool generates new hashes with the $2b$ prefix.

No — this is technically impossible. Bcrypt is a one-way function: there is no reverse operation that can recover the original plaintext from a hash. Applications therefore verify a password by hashing the entered text again and comparing it with the stored hash (exactly what the “Verify hash” section above does), not by “decrypting” the hash.

The slider ranges from 4 to 15 and defaults to 12. The tool rates each setting: up to 8 for testing only; 9 and 10 below the recommended minimum; 11 good security; 12 suitable for production use; 13 and 14 noticeably slower; and 15 significantly longer to compute. Each increase of one round doubles the computation time.

Bcrypt automatically adds a random salt to each hash, which is included in the resulting hash. This means the same plaintext produces a different 60-character hash each time—this is intentional and provides additional protection against rainbow table attacks. You can still use the “Verify hash” section, as the salt is already included in the stored hash.

Yes. bcrypt uses only the first 72 bytes of text; anything after that does not affect the hash. Characters such as ä take 2 bytes and emojis often take 4, so you can reach the limit in fewer than 72 characters. The tool counts the bytes and shows a warning during generation and verification if your text exceeds 72 bytes.

Hashing and verification run entirely in your browser using the bcryptjs library. Your text is not sent to a server or stored anywhere. The tool is intended for testing and learning. In production, hash passwords directly in your application using a trusted bcrypt library.