Bcrypt Hash Generator & Checker

1. Select the "Generate Hash" or "Verify Hash" tab.
2. To generate: enter a password, choose salt rounds, and click "Generate Hash".
3. To verify: enter a password and a bcrypt hash, then click "Verify".
4. Click "Copy" to copy the generated hash to your clipboard.

What is Bcrypt?

Bcrypt is an adaptive password hashing function designed by Niels Provos and David Mazières in 1999. It incorporates a salt to protect against rainbow table attacks and uses a configurable cost factor to remain resistant to brute-force attacks as computing power increases.

Unlike fast hash functions like MD5 or SHA-256, bcrypt is intentionally slow. This makes it ideal for password storage because even if a database is compromised, attackers cannot efficiently crack the hashed passwords. The cost factor (salt rounds) allows you to tune the computational difficulty over time.

How the Cost Factor Works

The cost factor (salt rounds) is an exponent: a cost of 10 means 2^10 = 1,024 iterations of the key derivation function. Each increment doubles the computation time. At cost 10, hashing takes roughly 100ms on modern hardware. At cost 12, it's around 300-400ms. At cost 14, you're looking at over a second. For most web applications, a cost factor of 10-12 balances security with acceptable login latency.

Why Bcrypt Beats SHA-256 for Passwords

SHA-256 is a general-purpose hash designed for speed. A GPU can compute billions of SHA-256 hashes per second. That's great for file checksums, terrible for passwords. Bcrypt's deliberate slowness means an attacker with a stolen database needs orders of magnitude more time to crack each password. It also includes a built-in salt, so identical passwords produce different hashes, defeating rainbow table attacks.

Argon2: The Newer Alternative

Argon2 won the Password Hashing Competition in 2015 and is now the recommended choice for new projects. Unlike bcrypt, Argon2 is memory-hard, requiring a configurable amount of RAM that makes GPU and ASIC attacks much more expensive. Bcrypt is still secure and widely deployed, so there's no rush to migrate existing systems. But if you're starting fresh, Argon2id (the hybrid variant) is the better pick.

Generate secure passwords to hash with our Password Generator. For general-purpose hashing, try the SHA-256 Hash Generator or the MD5 Hash Generator for non-security checksums.