How to generate or check a bcrypt hash
- To make a hash, choose "Generate a hash", type a password, set the cost factor, and press the button.
- Copy the result, which starts with
$2a$followed by the cost, the salt, and the hash. - To check a password, choose "Check a password", paste the hash, type the password, and press the button.
Higher costs run in a background thread so the page stays usable, and you can cancel a slow run. Do not type a real production password into any website you do not trust. This page sends nothing, but a throwaway test password is safest.
Questions
Is my password uploaded?
No. The hash is computed by a WebAssembly bcrypt engine inside your browser, in a background thread. Nothing is sent anywhere, and nothing is stored.
Which cost factor should I use?
Pick the highest value your server can afford while a login still feels instant, usually 10 to 12 today. The cost is stored inside the hash, so you can raise it later without breaking old hashes. Timings here are for your device, not your server.
Why does the same password give a different hash each time?
Every hash gets a new random 16-byte salt, which is stored inside the hash string. To compare a password with a hash, use "Check password", not a text comparison.
What do $2a$, $2b$, and $2y$ mean?
They are bcrypt version prefixes. This tool writes $2a$, the form every bcrypt library accepts, and checks hashes with any of them. For passwords under 72 bytes all versions give the same result.
Is there a password length limit?
Yes. Bcrypt reads only the first 72 bytes of a password, and characters outside basic English can take several bytes each. The tool warns you when a password goes over.
Credits
Built on hash-wasm (MIT). OneTooling is not affiliated with that project.