Bcrypt Hash Generator
Generate a properly salted bcrypt hash for storing a password.
How to use the Bcrypt Hash Generator
- Enter the password you want to hash.
- Pick a cost factor — 10 to 12 suits most sites.
- Click Generate and copy the hash into your database.
About the Bcrypt Hash Generator
bcrypt is what you should actually store when you save a password. Unlike MD5 or SHA-256 — which are built to be fast — bcrypt is deliberately slow, and you control exactly how slow via the cost factor. Each step up doubles the work, so cost 12 takes roughly four times as long as cost 10. That barely matters when a user logs in once, but it makes brute-forcing a stolen database enormously expensive.
bcrypt also salts every hash automatically. That is why clicking Generate twice on the same password gives two different hashes — and both are correct. The random salt is stored inside the hash string itself, which is what stops attackers from precomputing rainbow tables. To check a password later you never re-hash and compare; you use a verifier, which reads the salt out of the stored hash. Our bcrypt verifier does exactly that.
The output format is $2y$10$… — $2y$ marks bcrypt, then the cost, then salt and hash together in one 60-character string. This is the same format PHP's password_hash(), Python's bcrypt and Node's bcryptjs produce, so a hash generated here works with all of them.
Frequently asked questions
Why does the same password give a different hash every time?
Because bcrypt adds a random salt to each hash. This is intentional and is what makes bcrypt safe. Use a verifier — not a string comparison — to check a password.
What cost factor should I use?
Aim for roughly 250ms per hash on your own hardware. On typical shared hosting that is around 10 to 12. Higher is safer but slows down every login.
Is there a password length limit?
Yes — bcrypt only reads the first 72 bytes and silently ignores the rest. This tool warns you instead of quietly truncating. If you need longer, use Argon2.
bcrypt or Argon2?
Argon2id is the current recommendation and resists GPU cracking better. bcrypt remains a solid, extremely well-tested choice and is supported almost everywhere.
Is my password stored?
No. It is hashed and discarded immediately — never written to disk, never logged. For a live production password, generating it on your own server is still the safest habit.