What it does
The Bcrypt tool hashes a password with bcrypt and checks a password against an existing bcrypt hash. It is a quick way to create test users, reset a password directly in a development database, or confirm which password a stored hash belongs to.
How to use it
- Type a password: the hash updates automatically.
- Move the Cost factor slider: each step doubles the work (cost 10 means 2¹⁰ = 1,024 rounds).
- Click New salt for a fresh hash of the same password.
- To check a password, paste a Bcrypt hash ($2b$…), enter the Password to check and click Verify.
Example
A bcrypt hash at cost 10 looks like this:
$2b$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy
| Part | Meaning |
|---|---|
$2b$ |
bcrypt version |
10 |
cost factor |
| next 22 characters | the random salt |
| last 31 characters | the hash |
Your result will differ each time because the salt is random, and every version still verifies.
Good to know
- Cost 10 or higher is the current OWASP minimum. Pick the highest your server can handle in about a quarter of a second per login.
- bcrypt only uses the first 72 bytes of a password.
$2a$,$2b$and$2y$hashes are compatible for checking.- For Argon2id, scrypt or PBKDF2, use the Password Hasher.
FAQ
Can a bcrypt hash be decrypted? No. It is one-way; you can only check whether a given password matches.
Why is a higher cost slower in the browser? That is the point: each step doubles the time an attacker needs per guess.