Bcrypt Hash & Verify
Hash passwords with bcrypt and check hashes against plaintext
About this tool
Hash a password with bcrypt at a chosen cost factor, or verify a plaintext against an existing hash — both entirely in the browser, which is precisely what you want when the thing being tested is a password. A hash inspector also breaks any bcrypt hash into its version, cost and salt.
Bcrypt remains a solid choice for password storage because it is deliberately slow and per-password salted: the cost factor doubles the work with each increment, so cost 12 means 4096 iterations of the underlying cipher setup. The timing readout shows how long your chosen cost takes, making the security/latency tradeoff concrete.
Verification is the more common daily need: confirming that a hash in a database matches a known password without spinning up app code. Paste both, get a yes or no.
Frequently asked questions
- What cost factor should I use in production?
- The classic guidance: as high as your login latency budget allows, commonly 10–13 today. Aim for 100–300ms per hash on your production hardware. Browser JavaScript runs slower than native, so the timing shown here is an upper bound for your servers.
- Why does the same password give a different hash every time?
- A random 16-byte salt is generated per hash and stored inside the hash string itself. That is by design — identical passwords get different hashes, defeating precomputed rainbow tables. Verification reads the salt back out of the hash, which is why comparing works.
- What do the parts of a bcrypt hash mean?
- $2b$12$ + 53 chars: 2b is the algorithm version, 12 the cost (2^12 iterations), the next 22 characters the salt, and the final 31 the digest — all in bcrypt's own base64 alphabet. The inspector below the tool splits any hash this way.
- Is bcrypt still recommended over Argon2?
- Argon2id is the current first choice for new systems (memory-hardness resists GPU cracking). Bcrypt remains acceptable and ubiquitous — the practical advice is: do not migrate working bcrypt storage in panic, but pick Argon2id for greenfield designs. Both are leagues beyond fast hashes like SHA-256.