Bcrypt Generator

What this tool does

Bcrypt Generator produces modular crypt format hashes with the $2a$, $2b$ or $2y$ prefix used by login systems, htpasswd files and PHP’s password_hash function. It hashes one password or a batch of many, lets you verify a candidate password against a stored hash, and breaks an existing hash apart into its version, cost factor and salt for inspection. Everything runs through the bcryptjs library in your browser.

Unlike MD5 or SHA-256, bcrypt was built specifically to slow down password cracking. Each hash bakes in a cost factor that controls how many rounds of a modified Blowfish key schedule run, so doubling the cost roughly doubles the time an attacker needs per guess while leaving a real login barely noticeable. That deliberate slowness is why bcrypt remains a standard choice for storing passwords in web applications, content management systems and Apache htpasswd files decades after it was introduced.

This generator calls bcryptjs to produce a full modular crypt string such as $2b$12$ followed by a 22-character salt and a 31-character hash, reporting the time each one took so you can judge whether the cost factor suits your hardware. Batch mode hashes up to 200 passwords, one per line, and the verify tab checks a plaintext password against a pasted hash while also showing its version, numeric cost and embedded salt. Because bcrypt silently ignores bytes past the 72-byte password limit, the tool flags any input that would be truncated before you rely on it.

How to use Bcrypt Generator

1. Pick the “Generate hash” mode and type a password, or switch on batch mode to paste one password per line.
2. Drag the cost slider to set how many rounds (2^cost) the key schedule runs; higher costs take longer but resist cracking better.
3. Choose a version prefix: $2b$ for new systems, $2y$ for PHP’s password_hash and htpasswd, or $2a$ for older libraries.
4. Click Generate and copy the resulting hash, or download the batch as a text file.
5. Switch to “Verify & inspect”, paste an existing hash to see its version, cost and salt broken out.
6. Type the password you suspect produced that hash and click Verify to get a match or no-match result.

Tips for better results

• A cost of 10 is the historical bcrypt default and still common; OWASP recommends at least 10, and 12 is a comfortable choice on modern servers.
• Generating the same password twice gives two different hashes because a fresh random salt is drawn each time; that is expected and does not mean verification is broken.
• $2y$ and $2b$ describe the same algorithm with a different version tag, so a $2y$ hash from PHP will verify correctly once the prefix is normalised.
• Only the first 72 bytes of a password are used by bcrypt, so extremely long passphrases should be hashed first with SHA-256 if every character must matter.

Common use cases

• Seeding a test database with realistic password hashes without wiring up a backend.
• Checking why a login fails by verifying a candidate password against the hash stored for a user.
• Generating an htpasswd-compatible line for an Nginx or Apache basic-auth configuration.
• Comparing how long different cost factors take on your own hardware before choosing a production setting.

Common mistakes to avoid

• Picking a cost factor so high that login requests feel slow to real users; measure the time shown here on representative hardware first.
• Assuming two hashes of the same password should be identical; bcrypt’s random salt means they never will be, by design.
• Feeding a 200+ character passphrase and expecting every character to change the hash, when only the first 72 bytes are actually used.