🧂 Bcrypt Hash Generator & Verifier
Generate a bcrypt password hash, or check a password against a $2b$ hash, computed locally, the password never leaves your device.
Each +1 roughly doubles the time to compute. Higher is more resistant to brute-force but slower.
What is bcrypt? A deliberately slow password-hashing function with a built-in random salt and a tunable cost factor, used to store passwords safely. It is not a general-purpose or reversible hash. You cannot decode a password from its hash, only verify a guess against it. Higher cost makes brute-forcing harder but each hash slower to compute.
Everything runs locally in your browser. Your password is never uploaded or sent anywhere.
How the bcrypt hash generator & verifier works
Bcrypt is a deliberately slow password-hashing function with a built-in random salt and a tunable cost factor. The tool runs bcryptjs in your browser: in hash mode it produces a $2b$ hash at the cost you choose; in verify mode it checks a password against an existing hash. Because the salt is random, hashing the same password twice gives different hashes, and both still verify, which is exactly how bcrypt is meant to work.
Bcrypt is for storing passwords, not for general hashing or checksums. It is intentionally slow so that guessing passwords is expensive, and the cost factor lets you keep it slow as hardware speeds up (each +1 roughly doubles the time). It is not reversible: you never "decrypt" a bcrypt hash, you only verify a candidate password against it. Everything runs on your device, so the password is never transmitted.
Frequently asked questions
What is bcrypt used for?
Storing passwords securely. It is a slow, salted, one-way hashing function designed so that even if the hash database leaks, brute-forcing the original passwords is expensive. It's not for file checksums or general hashing.
What is the cost factor?
A number (commonly 10-12) that sets how much work each hash takes, each increment roughly doubles the time. Higher is more resistant to brute-force but slower to compute; pick the highest your server can tolerate.
Why does the same password produce different hashes?
Bcrypt generates a new random salt each time and stores it inside the hash, so two hashes of the same password differ, yet both verify correctly against that password. This is intended and improves security.
Can I decrypt a bcrypt hash?
No, bcrypt is one-way. You can't recover the password from the hash; you can only check whether a given password matches it, which is what verify mode does.
Is my password uploaded?
No, hashing and verification run entirely in your browser with bcryptjs. The password and hash never leave your device, and it works offline.