Bcrypt Hash Generator & Verifier

100% local cryptographic processing. Your sensitive inputs never leave your device.

Plaintext String to Hash

Salt Rounds

Higher numbers are more secure but take significantly longer.

Generated Bcrypt Hash

Output will appear here automatically as you type...

How does Bcrypt Hashing work?

Bcrypt is a password-hashing function designed by Niels Provos and David Mazières, based on the Blowfish cipher. It incorporates a salt to protect against rainbow table attacks and is an adaptive function—over time, the iteration count (salt rounds) can be increased to make it slower, ensuring it remains resistant to brute-force search attacks even as hardware speeds increase.

Why Salt Rounds Matter

The salt rounds parameter represents the cost factor. It determines how many iterations of the hashing algorithm are performed (calculated as 2^rounds). For example, 10 rounds means 1,024 iterations, while 12 rounds means 4,096 iterations. While higher rounds significantly improve security against database leak decryptions, they require more computational time, so choosing a balance (usually 10-12 for user passwords) is standard.

Frequently Asked Questions

What is bcrypt and why is it used for passwords?

bcrypt is a password-hashing function intentionally designed to be slow. Its cost factor lets you increase work as hardware improves — keeping brute-force attacks expensive. It also auto-generates a unique salt per hash.

What cost factor should I use?

Cost factor 10–12 is the standard for 2024. Factor 10 takes ~100 ms per hash on modern hardware — slow enough to deter attackers, fast enough for user login. Use 12+ for high-security systems where extra latency is acceptable.

Can a bcrypt hash be reversed or decrypted?

No. bcrypt is a one-way function — the hash cannot be decrypted. Verification works by hashing the candidate password with the same embedded salt and comparing the results.

What is the salt in a bcrypt hash?

A random 22-character value bcrypt generates and embeds in the output (the '$2b$10$...' prefix). The salt ensures two users with identical passwords produce different hashes, defeating rainbow table attacks.

How do I verify a password against a stored bcrypt hash?

Use bcrypt.compare(plaintext, storedHash) in Node.js or the equivalent in your language. Never compare strings directly — bcrypt must re-hash with the embedded salt. This tool generates the hash; use bcrypt verify at runtime.

Private & free — this tool runs entirely in your browser.