Bcrypt Hash Generator
Generate bcrypt password hashes locally in your browser with a selectable cost factor. Bcrypt is one-way password hashing, not MD5/SHA checksum or encryption. Read more
Generate bcrypt password hashes locally
Bcrypt is a one-way password hashing function designed to store passwords safely. It is not a general checksum like MD5 or SHA, and it is not encryption: a bcrypt hash cannot be decrypted back into the original password.
This tool runs entirely in your browser. Enter a password, choose a cost factor, and generate a standard encoded bcrypt hash that includes the algorithm version, cost, salt, and hash material needed for later verification.
How to use this bcrypt generator
- Enter the password in the Input panel.
- Choose a cost factor between 4 and 31. Higher values are slower and more resistant to guessing.
- Click Hash.
- Copy the encoded hash, then verify it with the Bcrypt Verify tool when needed.
Cost factor and the 72-byte password limit
Each increase in cost factor roughly doubles the work required. Cost 10 to 12 is a common interactive range, while 13 to 16 is noticeably slower. Cost 17 and above can take a long time and is uncommon for browser-side use. This page runs bcrypt in a worker so you can start another operation to cancel the current one, but high costs still require real CPU time.
Bcrypt only accepts passwords up to 72 UTF-8 bytes. Empty passwords and longer values are rejected by this tool.
Frequently asked questions
Is bcrypt the same as hashing a file with SHA-256?
No. SHA-family digests are fast checksums or general cryptographic hashes. Bcrypt is intentionally slow password hashing for password storage and verification.
Can I decrypt a bcrypt hash?
No. Bcrypt is one-way. You can only check whether a candidate password matches an existing hash with a verify step.
Why does the generated hash start with $2a$?
The underlying bcrypt implementation emits $2a$ encoded hashes. The Bcrypt Verify tool accepts standard bcrypt prefixes including $2a$, $2b$, $2x$, and $2y$.
Why does my password fail with a length error?
Bcrypt measures password length in UTF-8 bytes, not JavaScript string length. Multibyte characters count as more than one byte and the total must stay within 72 bytes.