Who this helps
- Developers checking bcrypt interoperability
- Learners comparing salts and work factors
Developer Security Utility
bcrypt Hash Generator
Convert passwords or text into bcrypt hashes and quickly verify whether the original text matches a bcrypt hash directly in the browser.
Salted Hash Generation
Generates a different bcrypt hash each time, even with the same input.
Adjustable Cost Factor
Adjust the rounds value to test hash strength for your environment.
Hash Verification
Check whether the original text matches a bcrypt hash instantly.
Security Testing Tool Notice
This page is a bcrypt tool for development testing and learning. Do not expose real user passwords in the browser; handle production passwords safely in server-side authentication logic.
Generate bcrypt Hash
Enter a password or text to hash, then choose a Cost Factor.
bcrypt is a one-way hash, so the original text cannot be decrypted from the generated hash.
Fast
10 rounds
Strong
Higher values take longer to compute but make brute-force attacks more expensive.
Because bcrypt includes a salt, the same text produces different hashes.
Original Length
0 chars
Cost Factor
10
Count
1
Elapsed Time
-
Generated Result
Copy the generated bcrypt hash or save it as a TXT file.
Enter the original text, then click Generate bcrypt Hash.
Verify bcrypt Hash
Check whether the original text and bcrypt hash match.
A typical bcrypt hash includes a $2a$, $2b$, or $2y$ prefix and is usually 60 characters long.
Enter the original text and bcrypt hash to verify.
Compare bcrypt hashes without losing spaces or UTF-8 bytes
Generate salted bcrypt hashes and compare them with a test input. The tool preserves spaces and rejects inputs over 72 UTF-8 bytes instead of silently truncating them.
When to use this tool
- Generate several hashes for one test string.
- Compare a Unicode input with a stored test hash.
From input to a checked result
- 1
Use a disposable test string.
- 2
Check leading and trailing spaces and the UTF-8 byte length.
- 3
Choose the work factor and number of hashes.
- 4
Generate and compare the different salted outputs.
- 5
Use the verification form with the same exact input, then test with your server library.
Same input, different salts
- Input
- demo-password; cost 10; 3 hashes
- Result
- Three different 60-character bcrypt hashes.
Each can verify against the same original input.
Emoji length boundary
- Input
- 18 copies of 😀, then 19 copies
- Result
- 18 use 72 UTF-8 bytes; 19 use 76 and are rejected.
The visible string-length counter is not a UTF-8 byte counter.
How it works
The bundled bcrypt library generates salts and hashes asynchronously. TextEncoder checks the 72-byte limit before generation and comparison. The input is not trimmed, so spaces are significant.
Limitations
- Browser timings do not represent authentication-server performance.
- Higher cost increases computation for both attackers and legitimate users.
- The generator's cost choices are 10–14; these are not universal performance recommendations.
- New password-storage designs should review current guidance, including memory-hard alternatives.
Your data
Processing is local; use test values. Copied hashes and downloaded files can remain on your device.
References
Related tools
- Password Generator
Choose length and character types to generate a hard-to-guess random password. The password is generated in your browser with strength, entropy, and character set details.
- UUID v1/v4 Compare Generator
Generate UUID v1 and UUID v4 at the same time and compare the differences between time-based and random-based UUIDs.
Frequently asked questions
Can I decrypt a hash?
No. Verification tests whether a candidate input matches the stored hash.
Why do identical inputs produce different hashes?
A new random salt is included in each generated hash.
Are spaces removed?
No. A value with surrounding spaces is a different input.