Loading…
Hash passwords with bcrypt (cost-configurable) and verify. Use for password storage; for fast checksums use hash-generator, for keyed MACs use hmac-generator. Input: password text. Returns bcrypt hash. 100% client-side.
Bcrypt Generator is loading — interactive editor will appear here. Use examples below to try instantly once loaded.
Press ? for keyboard shortcuts
Generates bcrypt password hashes and verifies passwords against existing bcrypt hashes. Supports configurable cost rounds (4-14), real-time hash generation, and one-click copy to clipboard.
Bcrypt is the industry standard for password hashing, but developers often need a quick way to generate hashes for testing or verify passwords without setting up a full backend. This tool provides a browser-based interface for both operations.
This tool is part of the DevStackIO platform — a collection of free online developer tools from DevStackIO. Browse more free developer resources on DevStackIO.
Backend developers implementing authentication systems, security engineers testing password storage, and developers migrating or verifying user credentials.
Select the mode: 'Generate' to create a new hash or 'Verify' to check a password against a hash
In Generate mode, enter your password and select the desired cost rounds (default: 10)
The bcrypt hash appears below with the standard $2b$ prefix
In Verify mode, enter the password and paste the bcrypt hash to check for a match
Click 'Copy' to copy the generated hash to your clipboard
Password: 'mySecret123', Cost: 10. Output: '$2b$10$Kx...'Verify: password 'hello' against hash '$2b$10$...' → Result: Match / No MatchPassword: 'P@ssw0rd!' at cost 12 → output begins '$2b$12$' and takes noticeably longer than cost 10The same password at cost 10 generates a different hash every run because of the random saltWhat is the cost rounds parameter?
It determines how many times the hashing algorithm iterates, exponentially increasing computation time (2^cost iterations).
Why does the output always look different for the same password?
Bcrypt includes a random salt, so each hash is unique even for identical inputs.
Is bcrypt still secure?
Yes, bcrypt is an adaptive hash function designed to remain secure as computing power increases.
What is the difference between $2a$, $2b$, and $2y$?
They are minor format variations from different implementations; $2b$ is the current standard.
Is my data shared?
No, hashing and verification run entirely in your browser.
Why can't I hash with SHA-256 for passwords?
Fast hashes let attackers brute-force millions of guesses per second; bcrypt's adaptive cost slows that down dramatically.
Authoritative specifications, standards, and in-depth reading for Bcrypt Generator.
Loading bcrypt library...
Generate MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes for text. Copy or compare instantly.
Generate time-based OTP codes from authenticator secret. Use for 2FA testing; for random tokens use token-generator. Input: Base32 secret. Returns 6-digit code + QR. 100% client-side.
Decode SSL certificates (subject/expiry/chain). Use for debugging certs. Input: PEM text ≤10MB. Returns parsed fields. 100% client-side.
Build Content-Security-Policy headers. Use for XSS hardening. Input: directive options. Returns policy string. 100% client-side.
Compute MD5/SHA-256/SHA-512 checksums for files to verify integrity. Use for files; for text strings use hash-generator. Input: file ≤10MB. Returns hex digests. 100% client-side, files never uploaded.
Infer JSON Schema from sample JSON for validation. Use when authoring schemas; for validating instances use json-validator. Input: JSON ≤10MB. Returns JSON Schema draft. 100% client-side.
Generate sortable ULIDs (time-ordered IDs). Use when ordering matters; for random UUIDs use uuid-generator, for tokens use token-generator. Input: count option. Returns ULID strings. 100% client-side.
Compute HMAC-SHA256/SHA512 for message authentication. Use for webhook signatures; for plain hashes use hash-generator. Input: message + secret key. Returns hex HMAC. 100% client-side.