About this tool
Bcrypt is a password-hashing function designed to be deliberately slow, which is exactly what you want: it makes brute-force guessing expensive. Its cost factor lets you dial that slowness up as hardware gets faster. Use the Hash tab to turn a password into a bcrypt hash for seeding a test database, and the Verify tab to check whether a password matches a hash you already have.
It runs in your browser with the bcryptjs library, so no password is ever sent to a server. Note that bcrypt is for storing passwords, not for encryption you can reverse.
Frequently asked questions
Why use bcrypt instead of SHA-256 for passwords?
SHA-256 is fast — great for file integrity but terrible for passwords, because attackers can try billions of guesses per second. bcrypt is deliberately slow and includes a per-hash random salt, which makes brute-forcing and precomputed rainbow-table attacks impractical.
What does the "cost" number mean?
Cost is a power-of-two work factor: each +1 roughly doubles the time to compute a hash. Cost 10 (the default) takes on the order of tens of milliseconds; cost 14-15 can take seconds. Pick the highest cost your server can afford per login without becoming a bottleneck.
Are my passwords sent to a server?
No. Hashing and verification run entirely in your browser, in a Web Worker when available so cost-15 hashing doesn't freeze the tab. Nothing you type here is transmitted or stored anywhere.
Why is every bcrypt hash of the same password different?
bcrypt generates a fresh random salt each time you hash, and that salt is embedded in the output string itself ($2b$10$<salt><hash>). That's expected, and it's exactly what stops two identical passwords from producing identical hashes.
Why did verification fail with "invalid hash format" instead of "no match"?
A valid bcrypt hash always matches the pattern $2a/b/x/y$<cost>$<53 characters>. If what you pasted doesn't match — truncated, wrong algorithm, extra whitespace — that's a different problem from a wrong password, so it's reported separately.