Bcrypt Hash 🔒 Runs locally in your browser — nothing is uploaded.

Hash a password with bcrypt, or check one against a hash.

 

About this tool

Bcrypt is a password-hashing function designed to be deliberately slow, which is exactly what you want: it makes brute-force guessing expensive. Its cost factor lets you dial that slowness up as hardware gets faster. Use the Hash tab to turn a password into a bcrypt hash for seeding a test database, and the Verify tab to check whether a password matches a hash you already have.

It runs in your browser with the bcryptjs library, so no password is ever sent to a server. Note that bcrypt is for storing passwords, not for encryption you can reverse.

Frequently asked questions

Why use bcrypt instead of SHA-256 for passwords?

SHA-256 is fast — great for file integrity but terrible for passwords, because attackers can try billions of guesses per second. bcrypt is deliberately slow and includes a per-hash random salt, which makes brute-forcing and precomputed rainbow-table attacks impractical.

What does the "cost" number mean?

Cost is a power-of-two work factor: each +1 roughly doubles the time to compute a hash. Cost 10 (the default) takes on the order of tens of milliseconds; cost 14-15 can take seconds. Pick the highest cost your server can afford per login without becoming a bottleneck.

Are my passwords sent to a server?

No. Hashing and verification run entirely in your browser, in a Web Worker when available so cost-15 hashing doesn't freeze the tab. Nothing you type here is transmitted or stored anywhere.

Why is every bcrypt hash of the same password different?

bcrypt generates a fresh random salt each time you hash, and that salt is embedded in the output string itself ($2b$10$<salt><hash>). That's expected, and it's exactly what stops two identical passwords from producing identical hashes.

Why did verification fail with "invalid hash format" instead of "no match"?

A valid bcrypt hash always matches the pattern $2a/b/x/y$<cost>$<53 characters>. If what you pasted doesn't match — truncated, wrong algorithm, extra whitespace — that's a different problem from a wrong password, so it's reported separately.