BCrypt Generator

Generate a BCrypt hash from a password. Select a cost factor, enter a password, and click Run — for development and test fixture creation only. Passwords longer than 1 KB are rejected.

  • Runs entirely in your browser
  • No data stored or sent to a server
  • Free forever — no signup
  • Instant conversion

Input and Output

Use the interactive encoder and decoder on this page to process your text.

Learn more about BCrypt

BCrypt Password Hashing Explained

BCrypt Hashing

When to Use BCrypt

BCrypt is designed for password hashing with a tunable cost factor that slows brute-force attacks. Use this tool to generate test hashes — production password hashing should always happen on your server.

Real-World Examples

Hash output: $2b$10$N9qo8uLOickgx2ZMRZoMye...

Cost 10 — common default (~100ms per hash on modern hardware)

Seed database fixtures with known password hashes for integration tests

Common Mistakes

  • Using SHA-256 or MD5 for passwords — too fast for password storage
  • Cost factor too low — vulnerable to offline brute force as hardware improves
  • Hashing passwords client-side before sending — use HTTPS and hash server-side

Developer Tips

  • Node.js: bcrypt.hash(password, 10)
  • Increase cost over time as CPUs get faster — rehash on login when cost is outdated
  • Consider Argon2id for new projects — BCrypt remains widely supported

Frequently asked questions

What cost factor should I use?

10 is the common default. Higher values are slower but more resistant to brute force. Target roughly 100–250ms per hash on your server.

What does the $2b$ prefix mean?

It identifies the BCrypt variant and algorithm version. The number after it (e.g. 10) is the cost factor (2^10 iterations).

Can I verify passwords with this tool?

This tool generates hashes. Use your application bcrypt.compare() or equivalent to verify passwords against stored hashes.