Bcrypt Generator
Create a bcrypt password hash with a random 16-byte salt and a cost factor from 4 to 12. The tool returns the standard modular crypt string starting with $2a$, which PHP password_verify, Node.js bcrypt, Spring Security and most frameworks accept. Use it to seed test users, reset an admin password in a database or check your own hashing code. The password is never echoed or stored.
Frequently asked questions
What is bcrypt?
Bcrypt is a password hashing function from 1999 based on the Blowfish cipher. It combines a random salt with a tunable cost, so each extra cost step doubles the work an attacker needs per guess. It remains a widely supported choice for password storage.
What does the output string mean?
A hash such as $2a$10$ followed by 53 characters contains the version 2a, the cost 10, a 22-character salt and a 31-character hash, all in bcrypt's own Base64 alphabet. Store the whole string, because the verifier reads the salt and cost from it.
Which cost factor should I choose?
The tool allows a cost from 4 to 12 and uses 10 by default, which is a common framework default. Each step doubles the time, so cost 12 takes about four times as long as cost 10. In production, pick the highest cost your servers can handle within roughly 100 to 250 milliseconds.
Why is the cost limited to 12?
Higher costs take seconds per hash and would let one request occupy the server for a long time. Cost 12 is already strong for most applications, and you can rehash with a higher cost in your own environment if needed.
Why does the same password give a different hash each time?
The tool generates a new random 16-byte salt for every hash. Different salts give different strings, but all of them verify against the same password. This stops attackers from using precomputed tables.
Is there a password length limit?
Yes. Bcrypt only uses the first 72 bytes of a password, so the tool rejects longer passwords instead of silently ignoring the rest. Non-ASCII characters take several bytes each in UTF-8.
Will PHP or Laravel accept a $2a$ hash?
Yes. PHP password_verify, Laravel, Symfony and WordPress plugins that use password_hash accept $2a$, $2b$ and $2y$ hashes, which differ only in historic bug fixes. Node.js bcrypt, bcryptjs, Python bcrypt and Spring Security accept $2a$ as well.
Is my password stored or logged?
No. The password is used only to compute the hash during the request. It is removed from the response and never written to logs or storage.
Should I use bcrypt or Argon2?
Argon2id is the newer recommendation from OWASP because it is memory hard, which makes GPU attacks more expensive. Bcrypt is still acceptable and has very broad library support, so it is a sound choice when Argon2 is not available.
How do I check a password against a bcrypt hash?
Use the Bcrypt Verifier on this site, or call your framework's verify function. Never compare bcrypt strings directly, because a new hash of the same password always looks different.