Security

bcrypt Hash Generator & Verifier

Hash passwords with bcrypt or verify a password against an existing hash — entirely in your browser.

Hashing runs locally in your browser. Your password is never uploaded, logged, or stored.

Generate hash

Verify hash

How to use

  1. To hash: enter a password, pick a cost (8, 10, or 12), and click Hash.
  2. To verify: paste a $2a$/$2b$/$2y$ hash, type the password to check, and click Verify.
  3. Copy the resulting hash straight into your database seed or config.

Why bcrypt for passwords?

bcrypt is a password hashing function built to be slow: each cost increment doubles the work an attacker must do per guess, while a 128-bit random salt makes rainbow tables useless. Unlike fast hashes such as SHA-256 or MD5, bcrypt stays expensive to brute-force even on GPUs. The salt here comes from crypto.getRandomValues, never a predictable PRNG.

Producing a server config line instead of a raw hash? Use the htpasswd Generator, and create the underlying password with the Password Generator.

Examples

Seed development users

Hash the passwords for fixture accounts before committing seed data.

Debug login failures

Verify whether a user-supplied password matches the stored hash when debugging auth issues.

Frequently Asked Questions

Is my password uploaded anywhere?+
No. The bcrypt computation runs entirely inside your browser.
Which hash prefixes can I verify?+
$2a$, $2b$, and $2y$ — the variants used by virtually every modern bcrypt implementation.
Why does the same password produce different hashes?+
Each hash embeds a fresh random salt. Verification compares against the salt stored inside the hash, which is why matching still works.
What cost should I use in production?+
Benchmark on your hardware; 10–12 is typical today. You can always re-hash with a higher cost later.

Related Tools

SecuritySecurity Analyzer

JWT Decoder & Security Analyzer

Decode JWT header and payload locally, then run security checks: weak algorithms, expiry, risky claims.

Security

Password Generator

Generate strong random passwords with crypto.getRandomValues — pick length and character sets.

Security

Random Token Generator

Generate cryptographically secure random tokens in hex, base64, or URL-safe base64.

Security

htpasswd Generator

Generate Apache/Nginx .htpasswd entries with bcrypt or {SHA} schemes — fully client-side.

Looking for something else? Browse all tools