About the Bcrypt Hash Generator
Bcrypt is a password-hashing function designed to be slow, which is exactly the property you want for stored passwords: it makes brute-force guessing expensive. Each hash includes a random salt and a cost factor, both embedded in the output string, so the same password produces a different hash each time and no separate salt column is needed. This tool generates a bcrypt hash from a password with the cost you select.
The cost factor sets how many rounds are used; each step up doubles the work. Ten is a common default; twelve is a good modern choice for a server; higher values are slower but stronger. Because the salt is random, generating the same password twice gives two different, equally valid hashes.
The hashing runs in your browser and nothing is transmitted, but a real password should be set in your application, not pasted into a web page. Use test passwords here. To check a password against an existing hash, use the Bcrypt Verify tool. Argon2 is a newer alternative in the Argon2 tool.
How to use
- Type a test password on the left.
- Choose a cost factor; 10 to 12 is typical.
- Copy the hash into your test database.
Common questions
- Why is the hash different every time?
- Bcrypt generates a random salt for each hash, so the same password produces different outputs. All of them verify correctly.
- What cost factor should I use?
- 10 is a common default; 12 is a good modern choice for a server. Higher is slower and stronger.
- Should I paste a real password here?
- No. Set real passwords in your application. Use this tool with test values.
- Do I need to store the salt separately?
- No. The salt and cost are part of the hash string, so storing the string is enough.