Free Password Hash Generator
Create secure password hashes with the right algorithm for the job. Choose battle-tested bcrypt or salted SHA-256/SHA-512, get a fresh cryptographically random salt every time, and verify hashes against passwords — all computed locally, never uploaded.
Password hash
Verify a hash
Verification
How to Use the Password Hash Generator
- Type the password to hash.
- Choose an algorithm: bcrypt (recommended) or salted SHA-256/SHA-512.
- Click Generate — a fresh random salt is created automatically.
- Use the verifier to check any password against a generated hash.
Features
Bcrypt mode uses the proven bcryptjs implementation with adjustable cost and per-hash random salts in standard $2a$ format. Salted SHA modes generate a 128-bit random salt via the Web Crypto API and output a self-describing salt$hash string. The built-in verifier handles both formats, so you can confirm hashes without writing any code.
Benefits & Use Cases
Developers seed local databases and test fixtures with realistic hashes; teams prototype auth flows before choosing a library; students compare how bcrypt output differs from salted SHA. Because everything runs on your CPU, test passwords never cross the network.
Tips
For anything resembling production, choose bcrypt with cost 10–12 — plain salted SHA is too fast and therefore too guessable for password storage. And remember: real user passwords must be hashed on your server, never in a user’s browser.
Frequently Asked Questions
Which password hashing algorithm should I use?
Bcrypt (or Argon2/scrypt) for real password storage — they are deliberately slow, which defeats brute-force attacks. Fast hashes like SHA-256, even salted, are only acceptable for non-security purposes.
What is a salt and why does it matter?
A salt is random data mixed into the hash so identical passwords produce different hashes. It defeats rainbow-table attacks, where attackers precompute hashes of common passwords.
Can I store the salt next to the hash?
Yes — salts are not secret. Bcrypt embeds the salt in its output string; this tool’s salted-SHA mode outputs salt and hash together so verification is self-contained.
How do I verify a password later?
Hash the candidate password with the same algorithm, salt, and cost, then compare the results — exactly what the verifier on this page does. Never compare plaintext passwords directly.
Is it safe to hash real passwords here?
Hashing is local, so nothing is transmitted. But as a rule, generate hashes for test and development use here; real user registration and login hashing belongs on your server.
Why is bcrypt slower than SHA?
That slowness is the security feature: it makes each password guess expensive for attackers while remaining unnoticeable (a fraction of a second) for legitimate logins.
Related Tools
Bcrypt Generator
Generate secure bcrypt password hashes free with NToolHub. Adjustable cost factor, built-in verifier — everything runs privately in your browser.
Open tool →Hash Generator
Generate MD5, SHA-1, SHA-256 and SHA-512 hashes at once with NToolHub’s free tool. Compare algorithms side by side — private in-browser hashing.
Open tool →UUID Generator
Generate version 4 UUIDs instantly with NToolHub’s free tool. Cryptographically random, bulk mode, uppercase option — 100% private.
Open tool →SHA512 Generator
Generate SHA-512 hashes instantly with NToolHub’s free tool. 128-char digests, live hashing, file checksums — 100% private in-browser.
Open tool →JWT Generator
Generate unsigned test JWTs instantly with NToolHub’s free tool. Custom header and payload, live decode preview — test-only, private.
Open tool →