Bcrypt Hash Generator and Checker
Create and verify bcrypt password hashes, and see what is inside one.
Use via API
Hash a password with bcrypt (random salt), or check a password against an existing bcrypt hash. Send JSON, get JSON back.
POST https://pithlab.com/api/v1/tools/bcrypt-generator
curl https://pithlab.com/api/v1/tools/bcrypt-generator \
-H "Authorization: Bearer $PITHLAB_KEY" \
-H "Content-Type: application/json" \
-d '{"mode":"hash","password":"correct horse battery staple","cost":10}'About the Bcrypt Generator
Hash a password with bcrypt at cost 4 to 15, check a password against a bcrypt hash, or split a hash into version, cost and salt. Runs in your browser.
How to use the Bcrypt Generator
- Choose Hash to create a new hash, Verify to test a password against an existing hash, or Parse to look inside a hash.
- To hash, type the password, pick a cost factor (12 is a sensible default) and press Generate hash. Each run uses a new random salt.
- To verify, enter the password and paste the hash, then press Check password.
- To parse, paste a hash to see its version, cost, number of rounds, salt and hash parts.
- Copy the result with the Copy button.
Examples
Input
$2a$06$DCq7YPn5Rq63x1Lad4cll.TV4S6ytwfsfvkgY8jIucDrjc8deX1s.
Output
Version $2a$, cost 6 (64 rounds), salt DCq7YPn5Rq63x1Lad4cll., hash TV4S6ytwfsfvkgY8jIucDrjc8deX1s.
Input
Password: abc. Hash: $2a$06$If6bvum7DFjUnE9p2uDeDu0YHzrHM6tf.iqN8.yx.jNN1ILEf7h0i
Output
Match
Input
correct horse battery staple
Output
e.g. $2b$12$ followed by a random 22-character salt and 31-character hash (60 characters in total)
Frequently asked questions
Why is the hash different every time?
bcrypt adds a random 16-byte salt to every hash, and the salt is stored inside the hash itself. Two hashes of the same password look different, but both verify correctly.
What cost factor should I use?
The cost is a power of two, so each step doubles the work. Pick the highest cost your server can afford for each login, usually 10 to 12 today. Above 13 the hash can take seconds, which is why this tool warns you and runs it in the background.
What is the 72-byte limit?
bcrypt only uses the first 72 bytes of a password and silently ignores the rest. Non-ASCII characters use 2 to 4 bytes each in UTF-8, so the limit can be reached with fewer than 72 characters. The tool warns you when it applies.
What is the difference between $2a$, $2b$ and $2y$?
They are the same algorithm with different version labels. $2b$ is the current OpenBSD label, $2y$ is what PHP and Apache use, and $2a$ is the older label that most libraries still accept. Hashes of passwords under 255 bytes are identical apart from the prefix.
Is my password sent anywhere?
No. Hashing and verification run in your browser using the bcryptjs library, and nothing you type is uploaded.