Free Bcrypt Hash Generator

Bcrypt is an adaptive password-hashing function designed to be deliberately slow. It combines a salt and a configurable work factor so that brute-force attacks stay expensive even as hardware gets faster. It is the recommended choice for storing passwords in most web applications.

The cost factor controls how much work hashing takes: each increment doubles the computation time. Cost 10 takes roughly a tenth of a second on modern hardware, while cost 12 takes about four times longer. Higher cost means stronger protection against guessing attacks.

No. Bcrypt is a one-way function. The only way to test a guess is to hash the guess with the same salt and cost and compare — which is exactly what the verifier on this page does.

Every bcrypt hash includes a randomly generated salt. The salt makes identical passwords produce different hashes, which defeats rainbow-table attacks.

For generating test hashes, seeds, and learning — yes, because nothing leaves your device. For real user registration and login, hashing must happen on your server so the plaintext password is protected in transit and at rest.

Cost 10 to 12 is the common recommendation today: slow enough to resist brute force (hundreds of milliseconds) but fast enough that users do not notice login delays. Revisit the value every couple of years as hardware improves.