Generate BCrypt Hash
Cost factor:
Password to hash
BCrypt Hash Output
Hash appears here…
Verify Password Against Hash
Plaintext password
BCrypt hash to verify against
What This Tool Does
This tool provides two functions: generating BCrypt hashes from plaintext passwords, and verifying a plaintext password against an existing BCrypt hash. It uses bcryptjs — a pure JavaScript BCrypt implementation that runs entirely in your browser. Your passwords are never transmitted anywhere.
Note: BCrypt is intentionally slow. Higher cost factors take longer to compute — this is by design and is what makes it resistant to brute-force attacks.
Frequently Asked Questions
What is BCrypt?
BCrypt is a password hashing algorithm designed by Niels Provos and David Mazières in 1999. Unlike MD5 or SHA, BCrypt is deliberately slow and includes a configurable work factor (cost) that makes brute-force attacks computationally expensive. It also automatically salts each hash, so two identical passwords produce different hashes.
What is the cost/rounds factor?
The cost factor (also called rounds or work factor) controls how computationally expensive the hashing is. Each increment doubles the time required. Cost 10 takes roughly 100ms, cost 12 takes about 400ms, cost 14 takes about 1.5 seconds. Higher cost is more secure but slower. Cost 10-12 is standard for most web applications in 2024.
Can BCrypt hashes be decrypted?
No. BCrypt is a one-way hash — it cannot be reversed or decrypted. Verification works by hashing the candidate password with the same salt (embedded in the hash) and comparing the result, not by decrypting.
Why does the same password produce different hashes?
BCrypt automatically generates a random salt for each hash. The salt is embedded in the resulting hash string, which is why two hashes of the same password look different but can both be verified correctly.
Is my password sent to a server?
No. This tool uses bcryptjs — a pure JavaScript BCrypt implementation that runs entirely in your browser. Your password never leaves your device.