Free Bcrypt Hash Generator
Generate and verify bcrypt password hashes instantly — free, no signup, entirely in your browser. Adjustable salt rounds (4–14), code examples in 7 languages.
Client-side only
No passwords sent to servers
No storage
Nothing is saved or logged
Open source
View code on GitHub
Hash Generator
Round 12 — Recommended (OWASP 2026)
Hash Verifier
Check if a password matches a bcrypt hash.
Frequently Asked Questions
What is bcrypt?+
Bcrypt is a password-hashing function designed by Niels Provos and David Mazières in 1999. It uses the Blowfish cipher and incorporates a salt to protect against rainbow table attacks. Its key feature is an adjustable cost factor (rounds) that makes it deliberately slow, protecting against brute-force attacks as hardware improves.
How many bcrypt rounds should I use in 2026?+
OWASP recommends a minimum of 12 rounds (cost factor) in 2026. Round 12 takes approximately 300ms on a modern server, which is slow enough to resist brute-force attacks but fast enough for production use. For higher security, use 13 or 14 rounds.
Is bcrypt still secure in 2026?+
Yes. Bcrypt remains a strong choice for password hashing in 2026. OWASP and NIST both recommend it with a cost factor of at least 12. While Argon2id is the latest recommendation for new systems, bcrypt with 12+ rounds is widely considered secure.
What is the difference between bcrypt and MD5?+
MD5 is a fast cryptographic hash function never designed for passwords — it can be brute-forced in seconds with modern GPUs. Bcrypt is a slow, salted password-hashing function designed specifically to resist brute-force attacks. Never use MD5 for password storage.
Can bcrypt hashes be reversed or decrypted?+
No. Bcrypt is a one-way hashing function — hashes cannot be reversed or decrypted. The only way to verify a password is to hash it with the same salt and compare the result. This is why even if a database is breached, bcrypt hashes cannot be reversed to plain-text passwords.
What does the $2b$ prefix mean in a bcrypt hash?+
The prefix identifies the bcrypt version. $2b$ is the current standard (fixed in 2011). $2a$ is an older version still widely used. $2y$ is used by PHP. All three are compatible in most implementations. The number after the prefix (e.g., $2b$12$) is the cost factor (rounds).
Is it safe to use this tool? Do you store my passwords?+
Yes, completely safe. All hashing and verification happens in your browser using JavaScript. No password or hash is ever sent to our servers. You can verify this by disconnecting from the internet — the tool still works. We have no server-side logging of any inputs.
What is Bcrypt?
Bcrypt is the industry standard for password hashing, designed to be computationally expensive by intent. Unlike MD5 or SHA-1, bcrypt uses a salt to prevent rainbow table attacks and an adjustable cost factor that scales with hardware improvements.
Every bcrypt hash begins with a version identifier ($2b$), followed by the cost factor and a 128-bit salt embedded directly in the hash. This means you only need to store the hash — the salt is included.