Bcrypt
Hash and compare text string using bcrypt. Bcrypt is a password-hashing function based on the Blowfish cipher.
About Bcrypt
bcrypt is a password-hashing function built on the Blowfish cipher. Unlike a plain hash, it is deliberately slow and adds a random salt, which makes stolen password databases far harder to crack. This tool creates a bcrypt hash and checks whether a text matches an existing one.
When you would use it
- Generating a hash to insert into a database or a seed script for a test user.
- Checking whether a stored hash really belongs to a given password while debugging a login problem.
- Trying different cost factors to see how long hashing takes on your device before choosing one for production.
How to use it
- In the hash section, enter the text and set the salt rounds (the cost factor, default 10).
- Copy the generated hash; it starts with $2 followed by the cost and the salt.
- In the compare section, enter a text and a hash and read whether they match.
Things worth knowing
- Each extra round roughly doubles the work. 10 to 12 is common today; higher values make logins slower for everyone, and very high values can freeze this page.
- The result changes every time because a new random salt is generated. Two different hashes of the same text are both valid, which is why you must use compare, not string equality.
- bcrypt only reads the first 72 bytes of its input. Anything beyond that, including long passphrases, is ignored.
- Hashing runs in the browser. Do not enter real user passwords into any online tool, including this one; use test values.
Frequently asked questions
- Why is my hash different from the one in the database?
- That is expected. The salt is random and stored inside the hash, so the same password produces a different string each time. Verify with the compare section, which reads the salt back out of the hash.
- What cost factor should I choose?
- Pick the highest value that keeps a single hash at roughly 100 to 300 ms on your production hardware, and revisit it every few years as computers get faster.