Skip to content
TextArray1.41.0
100% local

Bcrypt generator

Hash passwords with bcrypt or verify a password against an existing bcrypt hash.

Input
Output
Related tools
Hash generatorDeveloper tools
HMAC generatorDeveloper tools
Password strength checkerRandom generators
Password generatorRandom generators
i18n key diffDeveloper tools
TOML to JSON converterDeveloper tools
Bcrypt generator
Bcrypt is a password-hashing function built to be slow and salted, so it is the right tool for storing user passwords — and the wrong one for encrypting messages you plan to read back. This generator does two jobs. In hash mode it takes a password and returns a bcrypt hash such as $2b$10$… that you can store in a database. In verify mode it takes a password plus an existing hash and tells you whether they match, which is exactly what a login check does on the server.
The cost, or rounds, sets how much work each hash takes: every extra round doubles the time. A higher cost makes offline guessing slower for an attacker, but also makes each hash slower for you, so pick a value your hardware can afford on every login. This tool allows 4 to 12; the default of 10 is a common production choice. Because bcrypt runs entirely in your browser here, a high cost can take a noticeable moment on a phone — that is the algorithm working as designed, not a hang.
Every hash embeds its own random salt, generated with the browser's cryptographically secure random source, so hashing the same password twice gives two different hashes and both still verify. That salt is what defeats precomputed rainbow tables. Note that bcrypt only reads the first 72 bytes of a password.
Bcrypt is one-way: there is no "decrypt". You can only verify a candidate password against a stored hash, never recover the original from it. Everything happens locally in your browser — the password you type is never uploaded, logged or sent anywhere, which is what makes it safe to test real passwords here.
FAQ
Is bcrypt reversible — can I get the password back from the hash?
No. Bcrypt is a one-way hashing function, not encryption. There is no decrypt step and no key that turns a hash back into a password. All you can do is take a candidate password and verify whether it produces that hash, which is how a login check works.
What is the cost or rounds setting?
It is the work factor. Each extra round doubles the time bcrypt spends, so cost 12 is four times slower than cost 10. Higher is harder for an attacker to brute-force but slower on every login. Ten is a common default; this tool caps it at 12 so a single hash stays quick in the browser.
Why does the same password produce a different hash each time?
Every hash includes a fresh random salt, so identical passwords still hash to different strings. That is deliberate — it stops attackers from spotting reused passwords or using precomputed rainbow tables. Both hashes verify correctly against the original password.
Should I use bcrypt to encrypt text or files?
No. Bcrypt is only for hashing and verifying passwords. It cannot be decrypted, so it cannot protect a message you need to read back. For that use a proper cipher such as AES.
Is my password uploaded anywhere?
No. Both hashing and verification run entirely in your browser using its built-in crypto. The password you type is never sent to a server, stored or logged, so it is safe to test a real password here.