How to use
- Under Generate hash, type the password and adjust the cost (default 10).
- Click Generate hash and copy the result.
- Under Verify password, enter the password and the hash ($2a$, $2b$ or $2y$).
- Click Verify to see whether they match.
Use cases
- Creating an admin user's password hash for database seeds.
- Debugging login failures by comparing the password with the stored hash.
- Measuring how long each cost factor takes to tune your back end.
Technical concepts
Why bcrypt
bcrypt is a password key-derivation function based on the Blowfish cipher, deliberately slow and with a random 128-bit salt embedded in the hash itself. The salt defeats precomputed tables and makes identical passwords produce different hashes.
Cost factor
The cost sets 2^cost iterations of the key schedule. Each increment doubles the computation time. Current advice is to pick the highest cost that keeps login under roughly 250 ms on your server; 10 to 12 is common.
Anatomy of the hash
In $2b$10$N9qo8uLOickgx2ZMRZoMye..., 2b is the version, 10 the cost, the next 22 characters are the salt and the final 31 the hash, in bcrypt's own Base64 variant.
Frequently asked questions
Is there a password length limit?
Yes. bcrypt only considers the first 72 bytes. The tool warns when the password exceeds that limit; accented characters take 2 bytes in UTF-8.
What is the difference between $2a$, $2b$ and $2y$?
They are revisions that fix old implementation bugs. For ASCII passwords they are equivalent, and modern libraries verify all of them.
Why does hashing the same password twice give different results?
Each run uses a fresh random salt. Verification works because the salt is stored inside the hash.