•••
Live demoPassword Generator
Create strong, random passwords with custom rules.
Open full toolBCR
Bcrypt Generator
Hash and verify passwords using bcrypt, entirely offline.
bcrypt.tool
Rounds: 10
Higher rounds = slower to compute = more resistant to brute force. 10–12 is typical.
Uses bcryptjs (pure JS) - nothing is sent to a server.
What is a bcrypt generator?
This tool hashes passwords using bcrypt - the industry-standard, deliberately slow algorithm designed specifically for password storage - and can also verify whether a password matches an existing bcrypt hash. Unlike fast hashes like SHA-256, bcrypt's built-in slowness makes brute-force attacks impractical.
How to use this tool
- 1Hash mode: type a password, adjust the cost factor (rounds), and click Generate hash.
- 2Verify mode: enter a password and an existing bcrypt hash to check whether they match.
- 3Copy the generated hash to store or use elsewhere.
Common use cases
Generating a bcrypt hash to insert directly into a database for testing
Verifying whether a plaintext password matches a stored bcrypt hash
Understanding how the cost factor affects hashing time
Testing authentication logic without needing a running backend
Good to know
Frequently asked questions
What does the 'rounds' / cost factor control?
It controls how many times the underlying algorithm iterates - higher rounds mean the hash takes longer to compute, which makes brute-force attacks proportionally slower. 10–12 is a common default in production systems today.
Why does hashing take a moment for higher round counts?
That's intentional - bcrypt is designed to be slow so that attackers trying millions of password guesses are significantly slowed down, unlike fast hashes such as SHA-256.
Is this the same bcrypt used by backend frameworks?
Yes - it uses bcryptjs, a pure JavaScript implementation of the same bcrypt algorithm used by libraries across Node.js, Ruby, PHP, and other ecosystems, so hashes generated here are fully compatible.
Is my password sent anywhere?
No - hashing and verification both happen entirely in your browser.
quick_facts.json
{
"runs_in_browser": true,
"data_sent_to_server": false,
"signup_required": false,
"price": "free",
"category": "Security"
}