bcrypt

bcrypt Generator

Hash a password with bcrypt entirely in your browser. Pick a cost factor, generate the hash, and see how long it took. Nothing is uploaded.

Generate hash

Secure · local

Result

Verify a hash

About this tool

About bcrypt Generator

The bcrypt Generator hashes a password with bcrypt in your browser, letting you choose the cost factor and see how long it took. It is for developers learning or testing password hashing, with nothing uploaded.

bcrypt is a deliberately slow hash designed for storing passwords safely. Generating a hash locally lets you experiment with cost factors and timing without sending a password anywhere.

How to use

Step by step

  1. Enter the password you want to hash.
  2. Choose a cost factor; higher values are slower and harder to brute-force.
  3. Generate the bcrypt hash.
  4. Note the time it took, which reflects the cost factor.
  5. Copy the hash for your test or comparison.
Key features

What it offers

  • bcrypt hashing with adjustable cost factor
  • Timing feedback per hash
  • Runs in the browser — bcrypt
  • Nothing uploaded
Common use cases

Where it helps

  • Learning how bcrypt cost factors affect hashing time
  • Generating a test hash to verify a login implementation
  • Comparing bcrypt timing on your hardware
  • Demonstrating password hashing in a tutorial
Best practices

Tips for best results

  • Pick a cost factor that takes a noticeable fraction of a second on your server hardware.
  • Do the real hashing server-side; this tool is for learning and testing.
  • Remember bcrypt is one-way — you verify by hashing the input and comparing, not by decrypting.
Common mistakes to avoid

Pitfalls to watch for

  • Choosing a cost factor so low that hashing is fast and therefore weaker against brute force.
  • Treating bcrypt as encryption; it is a one-way hash and cannot be reversed.
  • Hashing passwords in client-side code for production, where the work belongs on the server.
Benefits

Why people use it

Adjustable work

The cost factor tunes how slow and resistant the hash is.

Tangible timing

See the cost factor’s effect in milliseconds.

Private

Passwords are hashed on your device.

Educational

A hands-on way to understand slow hashing.

FAQ

Common questions

Yes. bcrypt runs in your browser with a vendored library — your password never leaves your device.
Higher is slower and stronger. 10–12 is common for web apps; 12+ adds noticeable delay, which is shown after each hash.
Yes. Paste an existing bcrypt hash and a candidate password to check whether they match.
Standard $2b$ hashes, compatible with common server-side bcrypt libraries.
Private by design

This runs entirely in your browser

No file or text you enter here is uploaded. Encoding and decoding happen on your device using native browser APIs — close the tab and nothing remains on a server.

Install Toolisco Add it to your device for offline, one-tap access.