Bcrypt Hash Generator and Checker
Make a bcrypt hash for a test user or a seed script, or check whether a password matches a hash from your database. Choose the cost and see how long each hash takes.
How to create a bcrypt hash
- 1Type the password and choose the cost.
- 2Click “Hash password” and copy the hash.
- 3To check a password, paste it and a hash under “Check a password”.
Cost
The cost is the number of rounds as a power of two: each step up doubles the time it takes to compute a hash, and to guess passwords. 10 to 12 is typical for logins today.
The hash format
Hashes look like $2b$10$ followed by 53 characters: the version, the cost, a random 22-character salt and the hash itself. The same password gives a different hash every time because of the salt.
72 bytes
bcrypt only uses the first 72 bytes of a password, and you're warned if yours is longer.
Frequently asked questions
- Is my password sent anywhere?
- No. Hashing runs in your browser, with the bcryptjs library.
- Should I hash real passwords here?
- It's safe, since nothing leaves your device, but real systems should hash passwords on the server when users sign up.
- Do $2a$ and $2y$ hashes work?
- Yes, the checker accepts $2a$, $2b$, $2x$ and $2y$ hashes.