🧂 Bcrypt Hash Generator & Verifier
Generate a bcrypt password hash, or check a password against a $2b$ hash — computed locally, the password never leaves your device.
Each +1 roughly doubles the time to compute. Higher is more resistant to brute-force but slower.
What is bcrypt? A deliberately slow password-hashing function with a built-in random salt and a tunable cost factor, used to store passwords safely. It is not a general-purpose or reversible hash — you cannot decode a password from its hash, only verify a guess against it. Higher cost makes brute-forcing harder but each hash slower to compute.
Everything runs locally in your browser. Your password is never uploaded or sent anywhere.
How the bcrypt hash generator & verifier works
Bcrypt is a deliberately slow password-hashing function with a built-in random salt and a tunable cost factor. The tool runs bcryptjs in your browser: in hash mode it produces a $2b$ hash at the cost you choose; in verify mode it checks a password against an existing hash. Because the salt is random, hashing the same password twice gives different hashes — and both still verify, which is exactly how bcrypt is meant to work.
Bcrypt is for storing passwords, not for general hashing or checksums — it is intentionally slow so that guessing passwords is expensive, and the cost factor lets you keep it slow as hardware speeds up (each +1 roughly doubles the time). It is not reversible: you never "decrypt" a bcrypt hash, you only verify a candidate password against it. Everything runs on your device, so the password is never transmitted.
Frequently asked questions
What is bcrypt used for?
Storing passwords securely. It is a slow, salted, one-way hashing function designed so that even if the hash database leaks, brute-forcing the original passwords is expensive. It's not for file checksums or general hashing.
What is the cost factor?
A number (commonly 10–12) that sets how much work each hash takes — each increment roughly doubles the time. Higher is more resistant to brute-force but slower to compute; pick the highest your server can tolerate.
Why does the same password produce different hashes?
Bcrypt generates a new random salt each time and stores it inside the hash, so two hashes of the same password differ — yet both verify correctly against that password. This is intended and improves security.
Can I decrypt a bcrypt hash?
No — bcrypt is one-way. You can't recover the password from the hash; you can only check whether a given password matches it, which is what verify mode does.
Is my password uploaded?
No — hashing and verification run entirely in your browser with bcryptjs. The password and hash never leave your device, and it works offline.