Bcrypt Generator & Verifier
Type a password, set the cost, and generate a real bcrypt hash — a $2b$ string with the salt and work factor baked in. Paste a hash and a candidate password into the verify panel to check a match. Everything happens in your browser.
This bcrypt generator hashes a password with the genuine bcrypt algorithm and lets you verify a hash right back, all client-side. Bcrypt is built on the Blowfish key schedule and is deliberately slow, which is what makes stored passwords hard to crack. Drag the cost slider to change the salt rounds: each step doubles the work, so a higher cost means a slower hash for you and for any attacker. Every hash carries its own random salt inside the $2b$ string, so the same password never produces the same output twice — that is the point. Use it to create a bcrypt hash online, to test how the cost rounds affect speed, or to confirm a stored hash matches a password, with no upload and no sign-up.
Hash a password
—
Every hash uses a fresh random salt, so the same password gives a different string each time — the salt and cost are stored inside the hash itself.
Verify a hash
Paste a bcrypt hash and a candidate password to check them against each other.
How it works
- 1
Enter a password
Type into the password field, then set the cost you want. The hash is generated when you press the button, not on every keystroke, so the page never freezes.
- 2
Set the salt rounds
Drag the cost slider from 4 to 14. The readout shows the rounds and iteration count so you can see the work factor climb.
- 3
Generate or verify
Copy the $2b$ hash, or drop any bcrypt hash plus a candidate password into the verify panel to see a match or no-match.
Instant & 100% private — nothing is uploaded
Everything runs locally in your browser. Your code, text and files are processed on your own device and are never sent to a server — so there are no upload waits, no size limits from us, and nothing is ever stored or logged.
Frequently asked questions
- Is this a real bcrypt hash?
- Yes. It produces a standard bcrypt string (the $2a$/$2b$/$2y$ format) with the salt and cost embedded, the same output you would get from a server-side bcrypt library. It runs in your browser with no upload.
- Why does the hash change every time?
- Bcrypt generates a fresh random salt on each run, so the same password hashes to a different string every time. The salt lives inside the hash, which is how verification still works later.
- What do the cost / salt rounds do?
- The cost is the work factor: the number of key-expansion rounds is 2 to the power of the cost. Raising it makes each hash slower, which slows down brute-force attacks. Cost 10 to 12 is common for logins today.
- Can I verify a hash generated somewhere else?
- Yes, as long as it is a bcrypt hash in the $2a$, $2b$ or $2y$ format. Paste it with the password you want to test and the verify panel tells you whether they match.
- Is my password sent anywhere?
- No. Hashing and verification happen in JavaScript on this page. Nothing is transmitted or stored, so you can use it to generate a bcrypt password offline.
More tools
More from the Hivly network
Free sister tools on our other sites.
