Bcrypt Hash Generator and Checker

Create a hash

1. Open the Generate tab, type a password and choose the cost factor from 4 to 14.
2. Press Generate hash. Higher costs take longer: cost 12 is about 16 times slower than cost 8. The page stays responsive while it works.
3. Copy the hash that begins with $2b$ and store it in your database in a text column of at least 60 characters.

Check a password

Open the Verify tab, paste a stored hash and type a password. The tool tells you whether they match and shows the version, cost and salt parsed from the hash. This is handy when a login fails and you need to know if the stored value is a real bcrypt hash or was truncated or double-encoded.

Reading a bcrypt hash

A hash looks like $2b$12$abcdefghijklmnopqrstuuXXXXXXXX.... After the version comes the cost, then 22 characters of salt and 31 characters of hash, 60 characters in total. Because the cost sits inside the hash, you can raise it for new accounts and rehash old ones the next time each user logs in.

Good practice

• Never store plain passwords, and do not use fast hashes such as MD5 or SHA-1 for passwords.
• Use your language's maintained library on the server, for example password_hash in PHP, the bcrypt package in Node, or Laravel's Hash facade.
• Never compare hashes with ==. Use the library's verify function.
• Consider Argon2id for new systems if your stack supports it. bcrypt remains a sound, widely supported choice.