Bcrypt Generator

Generate and Verify bcrypt Hashes

bcrypt is the password-hashing standard behind Laravel, Django, Rails, Node, and countless auth systems. This tool does both sides of it: paste a password and get a real bcrypt hash at the cost factor you choose (rounds 4–15), or paste a password plus an existing hash and confirm whether they match. The salt is generated randomly and travels inside the hash string, so the same password produces a different hash every time — and both still verify.

It runs entirely in your browser using bcryptjs, the same pure-JavaScript implementation used across the Node ecosystem. Nothing is uploaded, stored, or logged — no server ever sees the password or the hash. That is exactly what you want when you are handling a credential, testing a login, or reproducing a colleague's hash.

Two honest caveats worth knowing: bcrypt only reads the first 72 bytes of a password (the tool warns you when you cross that line), and a high cost factor is deliberately slow — cost 15 runs 32,768 rounds and can briefly freeze the tab, so 10–12 is the usual production range. And while this is ideal for testing and verification, never paste a live production user's password into any web page — hash those on your own server.

Common Use Cases

• Seed a database: Generate a bcrypt hash for an admin or test user to drop straight into a users table or migration.
• Verify a login: Confirm a password matches the hash your app stored, without spinning up the whole app.
• Tune your cost factor: Feel how much slower each extra round is on your own hardware and pick a work factor your server can afford.
• Debug authentication: Reproduce or check a specific hash while chasing down a login bug.
• Read a hash: See the version, cost, and salt encoded inside a $2b$ string at a glance.
• Learn how bcrypt works: Watch the salt change on every run and confirm both hashes still verify against the same password.

Privacy: This tool runs entirely in your browser. The bcrypt library is loaded locally and every hash and comparison is computed on your device — no password, hash, or result is ever transmitted to a server, and the page makes no network calls at all.