Bcrypt Generator
Generate a salted bcrypt hash for a test password, or verify a candidate against an existing hash. Password values stay in this page’s memory and are not submitted by the widget.
0 / 72 UTF-8 bytes
Inputs are neither saved by this widget nor added to the page URL. Higher costs take longer to process.
Your salted hash will appear here after generation.
Cost and salt serve different purposes
The cost controls bcrypt’s work factor. Increasing it by one roughly doubles the hashing effort, so a setting that feels fast on a desktop may be slower elsewhere. This browser tool accepts costs 4 through 14 and defaults to 10; benchmark your own authentication system before selecting its production setting.
Each generation uses a fresh random salt. Hashing identical text twice should therefore produce different strings. Verification reads the salt and cost from the stored hash and checks the candidate against them. Bcrypt is a one-way password hash, so there is no corresponding decrypt operation.
The input limit counts bytes
Bcrypt processes at most 72 bytes of password input. Non-ASCII characters can take several UTF-8 bytes, so character count alone is insufficient. This page rejects longer input instead of silently truncating it. Its byte counter reflects the text exactly, including spaces.
The implementation is bcrypt.js, bundled with this site. It creates randomness through the browser’s cryptographic API and performs hashing asynchronously. Use sample credentials when evaluating the tool. Clearing the form removes its displayed values; it does not erase a hash you already copied to the clipboard.