Bcrypt Hash
Generate and verify bcrypt password hashes in your browser, with Argon2id and PBKDF2 as alternatives.
Hash a password
Verify a password
- Hex
- —
- Base64
- —
Related tools
How to hash a password with bcrypt
- Type the password and choose a cost factor — 10 is a sensible default, 12 is what many frameworks use today.
- Press Generate hash. The
$2a$10$…string contains the algorithm, the cost, a random 16-byte salt and the hash itself, so it is the only thing you need to store. - To test a login, paste the stored hash and a candidate password into Verify a password.
FAQ
Why is every hash of the same password different?
Bcrypt generates a new random salt each time, so two users with the same password get different hashes and a stolen database cannot be attacked with a precomputed rainbow table. Verification still works because the salt is stored inside the hash.
Which cost factor should I use?
Pick the highest cost your server can afford at peak login traffic — around 250 ms per hash is a common target, which is cost 11–13 on modern hardware. The timing shown here is measured in your browser and is usually slower than a server.
Bcrypt, Argon2 or PBKDF2?
Argon2id is the strongest modern choice because it also costs the attacker memory. Bcrypt is battle-tested and available everywhere. PBKDF2 is the weakest of the three against GPUs but is built into every platform, including the browser you are using right now.
Something missing or broken?
Request a tool, report a bug or share a tip with other users.