About the Bcrypt Hash Generator
This bcrypt generator creates password hashes in the standard $2b$ format used by PHP password_hash, Node bcrypt/bcryptjs, Python bcrypt, Spring Security, Laravel, Django’s BCrypt hasher and most other frameworks. Enter a password, choose the cost factor (work factor) and get a 60-character hash ready to seed a database, create an admin user or write a test fixture. Switch to Verify to check whether a password matches an existing hash — handy when debugging a login that fails.
A fresh random 128-bit salt is generated for every hash, so hashing the same password twice gives different results; that is expected, and verification still works because the salt is stored inside the hash. You can supply your own 22-character salt to reproduce a known hash for tests. The tool also decodes the hash into its version, cost and salt.
Hashing runs in your browser with the open-source bcryptjs library — nothing is sent to a server. Cost is limited to 14 here because each extra step doubles the work; production systems commonly use 10–12, tuned so one hash takes about 100–250 ms on the server.
How to use the bcrypt hash generator
- 1Choose Generate a hash or Verify a password.
- 2Type the password.
- 3To generate, pick a cost factor (10–12 is typical) and leave the salt blank.
- 4To verify, paste the stored hash and read Match or No match.
- 5Copy the hash into your database seed, config or test.
Formula and method
bcrypt is based on the Blowfish cipher’s expensive key schedule (“EksBlowfish”). It mixes the password and a 128-bit salt into the cipher state, then repeats the key expansion 2^cost times — 1,024 times at cost 10 — before encrypting the text “OrpheanBeholderScryDoubt” 64 times. The result is the 60-character string: version ($2b$), two-digit cost, 22 characters of salt and 31 characters of hash, using bcrypt’s own Base64 alphabet (./A–Z a–z 0–9).
Verification reads the version, cost and salt from the stored hash, re-runs the same computation on the candidate password and compares the result. Raising the cost by 1 doubles the time for both you and an attacker. Only the first 72 bytes of the password are used.
- cost
- Work factor, 4–31 (log₂ of the iterations)
- salt
- 16 random bytes, encoded as 22 characters
- hash
- 23 bytes of output, encoded as 31 characters
Worked examples
Reproduce a hash with a known salt
With cost 10 and the salt N9qo8uLOickgx2ZMRZoMye, “correct horse battery staple” (28 bytes) always produces this 60-character hash: $2b$, cost 10, the 22-character salt, then 31 characters of hash. Cost 10 means 2¹⁰ = 1,024 key expansions.
Verify a login password
The checker reads cost 12 and the salt R9h/cIPz0gi.URNNX3kh2O from the stored hash, hashes “hunter2” the same way and gets an identical result, so the password is correct.
A PHP $2y$ hash with the wrong password
PHP writes $2y$ for the same algorithm as $2b$. This hash was made from “hunter2” at cost 4 (2⁴ = 16 iterations), so “hunter3” does not match.
Frequently asked questions
Why is the bcrypt hash different every time?+
Each hash uses a new random salt, which is stored in characters 8–29 of the hash. Different salts give different hashes for the same password, which stops attackers using precomputed tables. Verification still works because the salt is read back from the stored hash.
What cost factor should I use for bcrypt?+
Pick the highest cost that keeps a single hash at roughly 100–250 ms on your production server — usually 10 to 12 today. OWASP recommends a minimum work factor of 10. Re-hash passwords at login when you raise it.
What is the difference between $2a$, $2b$ and $2y$?+
They are the same algorithm with different labels. $2b$ (2014) fixed a length-wraparound bug in OpenBSD’s $2a$ code, and PHP uses $2y$ for its corrected implementation. $2x$ marks hashes from an old buggy PHP version. Most libraries verify $2a$, $2b$ and $2y$ interchangeably.
Is there a maximum password length for bcrypt?+
Yes: bcrypt uses only the first 72 bytes. Multi-byte characters such as emoji take up to 4 bytes each, so the limit can be fewer than 72 characters. Some systems pre-hash long passwords with SHA-256 first; Argon2id has no such limit.
Can a bcrypt hash be decrypted?+
No. bcrypt is a one-way function, not encryption. The only way to recover a password is to guess candidates and hash each one, which the cost factor deliberately makes slow — a strong, unique password is effectively impossible to recover.