What is bcrypt?
bcrypt is a password hashing algorithm designed in 1999 by Niels Provos and David Mazières specifically for storing passwords securely. Unlike general-purpose hash functions like SHA-256, bcrypt is intentionally slow — it uses a cost factor (work factor) that controls how many iterations the algorithm runs. A cost of 10 means 2^10 = 1024 iterations; increasing it by 1 doubles the time. This makes brute-force and dictionary attacks much harder because the attacker must spend the same CPU time per guess that your server spent to hash. bcrypt also salts automatically, so two hashes of the same password are always different.
How to use this tool
- 1 Enter a password in the Hash tab and choose a cost factor (10 is the default; 12–13 is recommended for new systems).
- 2 Click Generate Hash — bcrypt runs asynchronously so the UI stays responsive. Higher cost factors take longer.
- 3 Copy the resulting $2b$… hash and store it in your database.
- 4 To verify a password, switch to the Verify tab, enter the candidate password and the stored hash, and click Verify.
Frequently asked questions
Is my password sent to a server?
No. Hashing and verification run entirely in your browser using the bcryptjs library. Nothing is transmitted.
What cost factor should I choose?
Choose the highest factor where your target hardware can hash in under 250ms per request. On a modern server, 12 or 13 is typical for new systems in 2024. The default of 10 was set in 1999 — adjust upward as hardware improves.
Why does bcrypt take so long at high cost factors?
That's intentional — the cost factor is the security mechanism. A cost of 14 means 2^14 = 16384 iterations. While annoying for a demo, it means an attacker cracking a stolen database must pay that cost for every guess.
What is the $2b$ prefix in the output?
The prefix encodes the bcrypt variant (2b = the modern variant), the cost factor, and the 22-character salt — all embedded in the hash string. Your verification library reads all of this automatically.
Can I use this tool to verify passwords stored by my backend?
Yes, as long as your backend used the bcrypt algorithm (most frameworks default to it). The library used here is compatible with hashes produced by Python, Node.js, Ruby, PHP, and Go bcrypt libraries.