Why Use This Tool?
Bcrypt is the right way to store passwords: it's deliberately slow, salts every hash automatically, and scales its cost as hardware improves. This generator produces properly formatted bcrypt hashes in your browser — the password never leaves the page.
The verify panel closes the loop: paste any existing bcrypt hash and a candidate password to check whether they match, exactly the way your application's login check does.
How It Works
- Enter a password and pick your cost rounds.
- Generate the salted hash and copy it into your database.
- Use the verify panel to test passwords against any existing hash.
Frequently Asked Questions
What is a bcrypt password hash?
A salted, deliberately slow hash in the format $2a$10$… used for password storage. The salt is embedded in the hash, so no separate salt storage is needed and identical passwords produce different hashes.
How many bcrypt rounds should I use?
Ten is the widely accepted default (~100ms per hash). Twelve is stronger and still acceptable for logins — each extra round doubles the time.
Why is this better than MD5 or SHA for passwords?
Bcrypt's built-in per-hash salt defeats rainbow tables, and its tunable slowness defeats brute force. Raw MD5 and SHA are too fast — attackers try billions per second.
Tips & Things to Watch
- Every hash is unique even for the same password — that's the salt working.
- Verification reads the cost rounds from the hash itself; no need to remember them.
- Never log or email the plaintext password — hash it and forget it.