Bcrypt
Hashes a password with bcrypt, or verifies that a plaintext password matches an existing hash — the standard approach for storing credentials.
Hash and compare text string using bcrypt. Bcrypt is a password-hashing function based on the Blowfish cipher.
Steps and notes
What is Bcrypt?
bcrypt is a password-specific hash: unlike SHA-256 it is deliberately slow, and the cost factor lets you slow it down further as hardware improves. Every bcrypt output embeds its own random salt and the cost in the string itself ($2b$10$... means cost 10), which is why the same password hashes differently every time and why verification needs no separate salt storage — the algorithm, salt and cost are all read back from the hash. This tool hashes with bcryptjs and verifies by re-hashing the candidate and comparing, exactly how a server does at login. Typical cost is 10–12: each step doubles the work, so cost 12 is roughly four times slower than cost 10 — pick the slowest value your login latency tolerates.
- Enter the plaintext password
- Click generate to get the hash
- To verify, put the hash in its field, enter the plaintext, then compare
- bcrypt is a hash, not encryption: it is irreversible, there is no "decrypt"
- A higher cost is slower and more secure; 10–12 is typical in production
- The same plaintext produces a different hash every time — that is expected (random salt)
Frequently asked questions
- Why does the same password produce different bcrypt hashes?
- By design: a fresh random salt is generated for every hash, so identical passwords produce different outputs and rainbow tables are useless. bcrypt verification handles this automatically — it reads the salt back out of the hash before comparing.
- What cost (salt rounds) should I choose?
- The rule of thumb is "about 250 ms per hash on your production hardware". Cost 10 is a common floor; 11–12 is typical today. Each +1 doubles the time for both you and the attacker, so take the slowest your login path can afford.
- Can I decrypt a bcrypt hash to get the password back?
- No, and any service claiming to is a scam. bcrypt is one-way; the only path is guessing candidates and hashing each one — which the cost factor is specifically engineered to make slow.
Category: Crypto
Hashing & crypto workflow
Hash Generator — MD5, SHA-1, SHA-256 Online → HMAC Generator — Sign Messages with SHA-256 Online → Bcrypt → Encrypt / decrypt text → RSA Key Pair Generator → Password strength analyser → htpasswd generator and checker