EN
My tools

Bcrypt Hash Generator & Checker

Hash a password with bcrypt at a chosen cost, or verify a password against an existing bcrypt hash. Reads the cost and salt from a hash. Runs in your browser.

Mode
10 is a common default. 13–14 are much slower.
My tools →
Advertisement

Bcrypt is a password-hashing function built to be slow, which makes brute-force attacks expensive. Each hash includes a random salt and a cost factor that sets how much work is required. This tool hashes a password at a cost you choose and verifies a password against an existing bcrypt hash — all in your browser.

How to use this tool

  1. Choose Hash or Verify.
  2. To hash, enter a password and pick a cost (10 is a sensible default).
  3. To verify, paste the password and the stored bcrypt hash.
  4. Copy the hash, or read whether the password matches.

Formula

A bcrypt string looks like $2b$10$<22-char salt><31-char hash>. The number after the prefix is the cost: the key-setup runs 2^cost times, so each step up doubles the work.

Example

Verifying the password "password" against $2a$04$AJ6PtAr3D6awLUS/tLJ2leWsZluJCrEcZo2CplM6hCgKCtAZvi6qe reports a Match and a cost of 4.

Frequently asked questions

What cost should I use?

A cost of 10–12 is common for web logins. Higher is more secure but slower; pick the highest value your server can tolerate for each login.

Why does the same password hash differently each time?

Because bcrypt generates a new random salt for every hash. Verification works because the salt is stored inside the hash string itself.

What is the 72-byte limit?

Bcrypt only processes the first 72 bytes of a password. Longer passwords are truncated, so very long passphrases should be pre-hashed before bcrypt in some designs.

Last updated:

Cite or embed this tool
APA

kakaoCalc. (2026, November 8). Bcrypt Hash Generator & Checker. https://kakao.mobile/tools/bcrypt-generator/

MLA

“Bcrypt Hash Generator & Checker.” kakaoCalc, 8 Nov. 2026, kakao.mobile/tools/bcrypt-generator/.

Paste this code into your page. The widget runs in your visitors' browsers, shows no ads and keeps a link back to this page. Embedding terms

Advertisement