BCrypt Hash & Verify

Generate bcrypt password hashes with a configurable cost factor, and verify a plaintext password against a bcrypt hash. Everything runs in your browser.

How it works

• bcrypt embeds a random 16-byte salt and the cost factor directly in the hash string, which starts with $2a$, $2b$, or $2y$.
• Hashing repeats its key schedule and Blowfish cipher 2^cost times — cost 10 means 1,024 rounds, cost 12 means 4,096.
• Verification re-derives the hash using the salt stored inside the given hash, then compares the result.
• All computation happens locally via the bundled bcryptjs library — no password or hash ever leaves your browser.

About BCrypt

bcrypt is a password hashing function designed to resist GPU and ASIC cracking. Unlike fast digests such as MD5 or SHA-1, it is deliberately slow and adaptive: every hash embeds a random salt, and a configurable cost factor scales the work so you can keep it slow enough as hardware improves. That combination — unique salt per password plus tunable cost — is why bcrypt (or argon2/scrypt) is the standard choice for storing passwords.

Use bcrypt whenever you store user passwords: hash them before saving and never store plaintext, and never use MD5, SHA-1, or plain SHA-256 for passwords, since those are fast enough to brute-force by the billions. The cost factor is a trade-off — higher cost means stronger hashes but slower logins and higher CPU load on your server (cost 10–12 is a common range in 2026). Finally, remember bcrypt is one-way: there is no decryption, so resetting a forgotten password means generating a new hash, not recovering the old one.