Online bcrypt Hash Generator and Verifier
Generate, verify, and parse bcrypt hashes with adjustable Cost and performance benchmarking, running locally in the browser
Online bcrypt Hash Generator and Verifier
bcrypt is designed specifically for password storage. It combines a salt with a configurable Cost factor, making password hashing deliberately expensive. Increasing Cost by 1 roughly doubles the calculation time. The tool provides generation, verification, and parsing modes.
Hash Generation
Choose a Cost from 4 to 15, with ranges grouped for testing, lower-cost use, recommended settings, and higher-cost settings. The default is 12. Password visibility can be toggled, and a browser-secure random test password can be generated. The result is a standard bcrypt hash string.
Password Verification
Enter a stored database hash and a password. The tool reads the bcrypt version and Cost from the hash, recalculates the password hash using those parameters, and compares the result without generating a new hash. Versions 2a, 2b, and 2y are supported. Version 2y is common in PHP environments, while 2b is widely used.
Hash Parsing
The parser extracts the version, Cost, 22-character salt, and 31-character hash body. Invalid formats are reported when the prefix is not 2a, 2b, or 2y, the body is shorter than 53 characters, or the Cost is outside the supported 4 to 31 range.
Performance Benchmark
The benchmark repeatedly calculates using the current Cost and reports average, minimum, and maximum calculation times. Around 100 to 250 ms is provided as a general tuning reference. Benchmark results depend on the current device and browser, so the actual server environment should be tested separately.
Important Notes
bcrypt only uses the first 72 bytes of a password. Password hashes are one-way and cannot be decrypted. If a high Cost causes calculation failures or excessive delays, reduce the Cost. If the local engine fails, the tool reports the error without falling back to server-side calculation.
Use Cases
Useful for selecting a backend Cost parameter, debugging login verification failures, inspecting historical bcrypt parameters, testing accounts, and learning how password hashing works.
Privacy and Data Security
bcrypt calculations use WebAssembly locally in the browser. Passwords and hashes are never uploaded or saved, and there is no server-side fallback when the local engine is unavailable.
Online bcrypt password hash generation, verification, and parsing
- Generate hashes with selectable Cost values from 4 to 15, defaulting to 12 and indicating recommended ranges
- Verify passwords by reading parameters from the stored hash, recalculating, and comparing results; supports 2a, 2b, and 2y
- Parse existing hashes to extract the version, Cost, salt, and hash body
- Benchmark repeated calculations with the current parameters and report average, fastest, slowest, and tuning guidance
- Generate random passwords, show or hide passwords, and warn that bcrypt only uses the first 72 bytes
- Clearly validate format errors, including invalid prefixes, bodies shorter than 53 characters, and Cost values outside 4 to 31