Bcrypt Generator
Hash and verify passwords with bcrypt, entirely inside your browser.
Why A Password Hasher Must Run Locally
Every online bcrypt generator asks you to type a password into someone else's server. Whatever the site promises, the password has at that point been disclosed to it, logged by whatever sits in front of it, and possibly stored. It is a strange thing to do with a credential.
This one runs entirely in the page. The Blowfish cipher, the expensive key schedule and the base64 encoding are all implemented here and verified against the canonical published test vectors, so the output is byte-identical to what any bcrypt library would produce.
Key features
- Nothing leaves the browser — no request is made when you hash or verify.
- Cost factor from 4 to 16 — with the number of key expansions shown, and honest advice about each range.
- Does not freeze the page — high costs are computed in slices with a progress bar, rather than blocking every click.
- Verification in constant time — the comparison runs over every character, so its timing reveals nothing.
- Shows the anatomy — prefix, cost, salt and digest broken out, because reading a hash is half of understanding it.
This tool runs entirely inside your browser using native Web APIs. Your files and text are never uploaded to a server, never logged and never shared with third parties.
How to use: Bcrypt Generator
- Type a password
Use a test value. Never paste a credential you actually use into any web page, including this one. - Choose a cost factor
10 to 12 is the usual range for a web application. The advice below the slider explains each band. - Generate
A random 16-byte salt is drawn from the browser's cryptographic random source. - Or verify instead
Paste an existing hash and a candidate password to check whether they match.
Technical specifications
| Processing location | Entirely in your browser — no server round trip |
|---|---|
| Data uploaded | None. Files and text never leave your device |
| Price | Free — no account, no trial, no usage cap |
| Category | Security |
| Works offline | Yes, once the page has loaded |
| Browser support | Chrome 90+, Edge 90+, Firefox 90+, Safari 15+ |
| Interface languages | English, 中文, हिन्दी, Español, العربية |
Frequently asked questions
What cost factor should I use?
Pick the highest your server can afford at your login rate. Cost 12 is a common default and takes roughly a quarter of a second on typical hardware. The right way to choose is to measure on your own server under load, not to copy a number — and to revisit it every few years, since the point of the factor is to keep pace with hardware.
Why is every hash different for the same password?
Because each one uses a new random salt, which is stored inside the hash string itself. That is the whole purpose: identical passwords produce different hashes, so an attacker cannot tell that two accounts share one, and a precomputed table is useless. Verification re-derives the hash using the salt from the stored string.
What is the difference between $2a$, $2b$ and $2y$?
They are revision markers. $2a$ is the original, $2y$ was introduced by PHP after a bug in one implementation, and $2b$ is the current form from OpenBSD. For any password under 256 bytes all three produce identical output — the differences only appear in edge cases that no real password reaches. Use $2b$ unless a system requires otherwise.
Why does bcrypt ignore anything past 72 characters?
It is a property of the algorithm, not of this implementation. The key material is fed into an 18-word array cyclically, and past 72 bytes the additional input stops changing the result. Any bcrypt library behaves the same way. If you need long passphrases to count in full, hash them with SHA-256 first or use Argon2 instead.
Is bcrypt still the right choice?
It remains a sound choice and is very widely supported. Argon2id is the current recommendation for new systems because it resists GPU and custom-hardware attacks better by being memory-hard as well as slow. If you are already on bcrypt with a sensible cost factor, that is not an emergency.