Bcrypt Hash Generator
Hash FunctionsProcessed locally in your browser using the Web Crypto API. Nothing is sent to any server.
How It Works
This tool implements the bcrypt password hashing algorithm, the most widely used adaptive hash function for password storage.
Algorithm Details
- Algorithm: bcrypt (Provos & Mazieres, 1999)
- Based on: Blowfish cipher (Eksblowfish key schedule)
- Output format:
$2a$XX$<salt><hash> - Salt: 128 bits (16 bytes), randomly generated
- Max password: 72 bytes (truncated beyond this)
- Cost range: 4-14 (2^cost iterations)
Why Bcrypt?
Unlike fast hash functions (SHA-256, MD5), bcrypt is intentionally slow and memory-hard. This makes GPU and ASIC brute-force attacks impractical. The adaptive cost factor lets you increase difficulty as hardware improves.
Cost Factor Guide
- Cost 10: ~100ms — acceptable for login flows
- Cost 12: ~400ms — recommended for production
- Cost 14: ~1.6s — high-security applications
Frequently Asked Questions
What is bcrypt?
Bcrypt is a password hashing algorithm based on the Blowfish cipher, designed by Niels Provos and David Mazieres in 1999. It uses a configurable cost factor to make brute-force attacks computationally expensive.
What does the cost factor do?
The cost factor (4-14) controls how many iterations the algorithm performs: 2^cost iterations. Higher cost means slower hashing, which makes brute-force attacks more difficult. Cost 10-12 is recommended for most applications.
Why is the output always $2a$...
The $2a$ prefix identifies the bcrypt version. The format is $2a$XX$<22-char salt><31-char hash>, where XX is the cost factor. The salt ensures identical passwords produce different hashes.
Is the hashing done client-side?
Yes. All bcrypt computation happens locally in your browser. Passwords are never sent to any server.
Privacy Note
This tool runs entirely in your browser. Your input is never uploaded, stored, or sent to any server.
Disclaimer: This tool is provided for educational and informational purposes only. The results do not constitute professional security advice. Use at your own discretion.