Online bcrypt Hash Generator and Verifier

Report a Problem
bcrypt only uses the first 72 bytes of a password. Any additional bytes are ignored.
Each increase of 1 in Cost approximately doubles the computation cost. A Cost of 10–12 is recommended; use about 100–250 ms per hash as a tuning reference and benchmark on the target server.
Random passwords are generated using the browser CSPRNG and are intended for parameter testing only. Do not use them for real accounts.
Browser-local Calculation
Run the calculation repeatedly with the current parameters and use the average time to help select parameters suitable for the target environment.
Benchmark results only represent the current device and browser. Measure actual server performance in the target environment.
Verification reads the parameters stored in the hash, recalculates the hash, and compares the results. No new hash is generated.
Paste a bcrypt hash from your database to read its version and Cost parameters. Everything is processed offline.
Hashes using versions 2a, 2b, and 2y can all be verified. 2y is common in the PHP ecosystem, while 2b is the current mainstream implementation.
Password hashing is one-way and irreversible; there is no “decryption”. This tool only performs hashing, verification, and parameter parsing.
Privacy Notice：All calculations are performed locally in the browser using WebAssembly. Passwords and hashes are never uploaded or stored.

Generate, verify, and parse bcrypt hashes with adjustable Cost and performance benchmarking, running locally in the browser

Online bcrypt Hash Generator and Verifier

bcrypt is designed specifically for password storage. It combines a salt with a configurable Cost factor, making password hashing deliberately expensive. Increasing Cost by 1 roughly doubles the calculation time. The tool provides generation, verification, and parsing modes.

Hash Generation

Choose a Cost from 4 to 15, with ranges grouped for testing, lower-cost use, recommended settings, and higher-cost settings. The default is 12. Password visibility can be toggled, and a browser-secure random test password can be generated. The result is a standard bcrypt hash string.

Password Verification

Enter a stored database hash and a password. The tool reads the bcrypt version and Cost from the hash, recalculates the password hash using those parameters, and compares the result without generating a new hash. Versions 2a, 2b, and 2y are supported. Version 2y is common in PHP environments, while 2b is widely used.

Hash Parsing

The parser extracts the version, Cost, 22-character salt, and 31-character hash body. Invalid formats are reported when the prefix is not 2a, 2b, or 2y, the body is shorter than 53 characters, or the Cost is outside the supported 4 to 31 range.

Performance Benchmark

The benchmark repeatedly calculates using the current Cost and reports average, minimum, and maximum calculation times. Around 100 to 250 ms is provided as a general tuning reference. Benchmark results depend on the current device and browser, so the actual server environment should be tested separately.

Important Notes

bcrypt only uses the first 72 bytes of a password. Password hashes are one-way and cannot be decrypted. If a high Cost causes calculation failures or excessive delays, reduce the Cost. If the local engine fails, the tool reports the error without falling back to server-side calculation.

Use Cases

Useful for selecting a backend Cost parameter, debugging login verification failures, inspecting historical bcrypt parameters, testing accounts, and learning how password hashing works.

Privacy and Data Security

bcrypt calculations use WebAssembly locally in the browser. Passwords and hashes are never uploaded or saved, and there is no server-side fallback when the local engine is unavailable.

Online bcrypt password hash generation, verification, and parsing

bcrypt is a password-storage hashing algorithm that uses a Cost work factor to control computational expense and increase the cost of brute-force attacks.
  • Generate hashes with selectable Cost values from 4 to 15, defaulting to 12 and indicating recommended ranges
  • Verify passwords by reading parameters from the stored hash, recalculating, and comparing results; supports 2a, 2b, and 2y
  • Parse existing hashes to extract the version, Cost, salt, and hash body
  • Benchmark repeated calculations with the current parameters and report average, fastest, slowest, and tuning guidance
  • Generate random passwords, show or hide passwords, and warn that bcrypt only uses the first 72 bytes
  • Clearly validate format errors, including invalid prefixes, bodies shorter than 53 characters, and Cost values outside 4 to 31
Suitable for backend Cost selection, troubleshooting login verification failures, and checking historical database hashes. All calculations run locally in the browser using WebAssembly. Passwords and hashes are not uploaded, and there is no server-side fallback calculation.
Comments 0
No comments yet. Be the first to comment!
Comment content cannot be empty
0/255