Proper password hashing with bcrypt
Passwords should never be stored as plain text or as a fast hash like MD5 or SHA-256, because attackers can test billions of guesses per second against those. bcrypt is deliberately slow and adds a random salt to every hash, so identical passwords produce different hashes and each guess costs real time.
Enter a password, choose the cost factor (each step doubles the work), and generate a standard $2b$ hash you can store in a database or use in test fixtures. Switch to Check a password to verify a password against an existing bcrypt hash from your app. Everything runs in your browser — the password is never sent anywhere.
How to create a bcrypt hash
- 1
Type the password
Use the eye icon to show or hide it.
- 2
Choose the cost factor
10 to 12 suits most web apps.
- 3
Generate the hash
Copy the 60-character result.
- 4
Or check a password
Paste a hash to verify a match.
Key features
Real bcrypt
Compatible with PHP, Node.js, Python, Ruby and Go libraries.
Adjustable cost
From 4 (testing) to 15 (very slow).
Verify mode
Check any password against a $2a$, $2b$ or $2y$ hash.
72-byte warning
Alerts you when bcrypt would ignore part of a long password.
Common uses
- Seeding test users: Create hashes for fixtures and staging accounts.
- Debugging logins: Check whether a stored hash matches a known password.
- Learning security: See how salting and cost factors work.
Tips and good to know
- Never reuse a real user's password for testing; generate a new one with the Password Generator.
- For checksums and data integrity (not passwords), use the SHA-256 Hash Generator.