Bcrypt Generator & Checker

bcrypt is the password-hashing method behind countless logins: instead of storing your password, a website stores a scrambled “hash” that is deliberately slow to make. This tool makes those hashes and checks them. Use “Generate hash” to turn a password into a $2b$, $2y$ or $2a$ hash at the cost you choose, or “Check a password” to find out whether a password matches a hash you already have, such as one from a test database or a config file.

It is built for developers who want to seed a user table, test a login, or understand why a hash looks the way it does. Every hash is split into its four parts, version, cost, salt and checksum, with a plain explanation of each, and the tool times the work on your own device so you can pick a sensible cost. It also warns you when a password runs past bcrypt’s 72-byte limit, a detail most online generators never mention.

Pasting a real password into a website should make you nervous, so this one does all its work in your browser. The bcrypt code was written for this tool, checked against the published OpenBSD and jBCrypt test hashes, and runs in a background worker so the page stays responsive. Nothing is uploaded, logged or stored.

1. Choose “Generate hash” or “Check a password” at the top.
2. To make a hash, type the password, drag the Cost slider (10 is the usual choice) and pick a version: $2b$ for most languages, $2y$ for PHP.
3. Press “Generate hash” or Enter. The hash appears with the time it took, and “Copy hash” puts it on your clipboard. “New salt” makes a fresh one.
4. To check, type the password and paste the hash. The answer, match or no match, appears as you type, with each part of the hash explained below.

• Generate bcrypt hashes at any cost from 4 to 15, with a live estimate of the time on your device after the first hash.
• Check a password against any $2a$, $2b$ or $2y$ hash, at any cost from 4 to 31, with the answer shown as you type.
• Hash anatomy: version, cost, salt and checksum shown in colour, with what each one means and the salt in hexadecimal.
• A fresh 16-byte salt from your browser’s secure random generator (crypto.getRandomValues) for every hash.
• An honest 72-byte counter that tells you when part of a long password is being ignored, and which part.
• Full Unicode support: passwords are turned into UTF-8 bytes first, the same as PHP, Node and Python.
• Plain-English problems for pasted hashes: wrong length, cut-off copies, other hash types such as Argon2.
• Runs in a background worker, with a progress bar for slow costs, so the page never freezes.

• For a real server, pick the highest cost that keeps a login under about a quarter of a second on that server. Cost 10 to 12 is typical today; this page times it on your device, which may be faster or slower than your server.
• Each step up in cost doubles the time: cost 15 is 32 times slower than cost 10.
• The same password gives a different hash every time because the salt is random. That is expected; checking still works.
• $2y$ and $2b$ are the same algorithm with different labels. If a library refuses one, changing the label to the other usually works.
• bcrypt reads only the first 72 bytes. For longer passphrases, many systems pre-hash the password (for example with SHA-256) before bcrypt; this tool hashes exactly what you type.