Bcrypt Hash Generator & Checker — Create and Verify Bcrypt Hashes Online

This is a real bcrypt tool, not a simulator: it runs a complete, test-verified bcrypt implementation (EksBlowfish) in pure JavaScript, right in your browser. Generate a genuine $2b$ hash of a password with your choice of cost factor, or paste an existing bcrypt hash and check whether a password matches it.

Use it to sanity-check the hashes your application produces, to learn how cost changes hashing time, or to confirm a password against a hash from a database dump — without sending the password anywhere. Everything happens locally; nothing is uploaded.

What bcrypt does differently

Most hash functions are built for speed, which is exactly wrong for passwords: a fast hash lets an attacker test billions of guesses per second. Bcrypt (1999, by Niels Provos and David Mazières) is deliberately slow and adaptive. It is built on the Blowfish cipher’s expensive key schedule — EksBlowfish — and its cost factor sets how many times that schedule repeats: the work doubles with every +1. A hash that takes 250 ms to compute is nothing to a login page and a fortune to a brute-force attack. Bcrypt also mixes a 128-bit random salt into every hash, so two users with the same password get different hashes and rainbow tables are useless.

Anatomy of a bcrypt hash

A bcrypt hash is a 60-character string like $2b$10$N9qo8uLOickgx2ZMRZoMyeksCv09xp/bZS5MQ9z7mpI.Gbtgo7JEe. It reads left to right: $2b$ is the algorithm version, 10$ is the cost (2¹⁰ rounds), the next 22 characters are the salt in bcrypt’s own base64 alphabet, and the final 31 characters are the actual hash. That example is real, by the way: it is the bcrypt of the password hello world at cost 10 with that salt — paste the hash into the checker above and test it.

How to use the generator

Type a password, pick a cost, and generate. Cost 10 takes a fraction of a second here; cost 12 is roughly four times slower — try both and you will feel the adaptive design working. Every generation uses a fresh random salt, so hashing the same password twice gives two different strings, both valid. That is expected behaviour, not an error.

How to use the checker

Paste a full bcrypt hash ( $2a$ , $2b$ and $2y$ are all accepted) and the password you want to test. The tool re-computes the hash with the salt and cost stored inside the string and compares. Developers use this to verify that a login bug is in their code and not in the stored hash; support teams use it to confirm a test account’s password without resetting it.

Honest limits

Bcrypt only uses the first 72 bytes of a password; anything longer is ignored, which surprises people testing passphrases. This browser implementation is correct — it is verified against reference outputs from the system crypt library — but it is slower than native code, so costs above 12 are not offered. And a warning that matters: never type a real production password into any online tool, including this one. This page runs locally and uploads nothing, but the safe habit is to test with throwaway passwords only.

Frequently asked questions

Is this a simulator or the real algorithm?

The real algorithm. The generator and checker run a complete EksBlowfish/bcrypt implementation in JavaScript, and its output has been tested byte-for-byte against the reference bcrypt implementation used by Linux systems across known passwords, salts and cost factors.

What cost factor should I use?

For a real application, pick the highest cost that keeps a single login under roughly 250-500 ms on your server — today that is usually 10-12. This tool caps at 12 because browser JavaScript is slower than server code.

Why is my hash different every time?

Because of the random salt. Each generation draws 16 fresh random bytes, so the same password produces a different — equally valid — hash string.

Can bcrypt hashes be cracked or reversed?

They cannot be reversed; they can only be guessed, one password at a time, at the cost the factor imposes. That is the whole point: a strong, unique password stays out of reach, while a weak one like “123456” falls to the first dictionary an attacker tries.

Embed this tool on your website — free

Copy the code below to add this working tool to your own page. A small credit link stays with it — that’s all we ask.

Bcrypt Hash Generator and Checker — Hash and Verify Passwords Online