How to use the Bcrypt Hash Generator
- 1. Pick a modeGenerate a new hash, or check a password against one.
- 2. Set the costHigher cost is slower and stronger; 10 to 12 is common.
- 3. Copy the hashUse it for test data, or read the match result.
Anatomy of a bcrypt hash
A bcrypt hash such as $2a$10$N9qo8uLOickgx2ZMRZoMye… is 60 characters long and contains everything needed to check it later: the version prefix ($2a$, $2b$ or $2y$), the cost factor (10 here, meaning 2¹⁰ = 1,024 rounds of the key setup), a 22-character salt and the 31-character hash itself. With the default settings this tool produces hashes that start with $2a$10$.
Because a new random salt is used every time, hashing the same password twice gives two different results, and both still verify correctly. That stops attackers from using precomputed tables.
Choosing a cost and other good practice
- Each +1 doubles the time. Pick the highest cost your server can handle while keeping logins quick; the tool shows how long it takes in your browser.
- 72-byte limit: bcrypt ignores anything after 72 bytes, so the tool warns about long inputs.
- Never use MD5 or SHA-256 alone for passwords; they are designed to be fast, which helps attackers.
- Argon2id is the modern first choice in OWASP's guidance, with bcrypt a solid option for existing systems.
Hashing uses bcryptjs 2.4.3, an open-source JavaScript implementation, loaded from cdnjs and run in your browser; passwords are not sent anywhere. If the library cannot load, the page says so instead of failing silently. Use generated hashes for test accounts and learning; in production, hash on your server with your framework's library. See how fast attackers can guess with the password crack time calculator.
Frequently asked questions
What is the difference between $2a$, $2b$ and $2y$?
They are versions with small bug fixes. Modern libraries accept all three for checking; this tool creates $2a$ hashes.
Can a bcrypt hash be reversed?
No. You can only check guesses against it, which bcrypt deliberately makes slow.
Is the Bcrypt Hash Generator free?
Yes, the Bcrypt Hash Generator is free. The first time you generate or check your first hash, you are asked for your name and WhatsApp number once. After that, this and every other Uncodemy tool opens straight away without the form.