BCrypt Hash Generator
Generate a bcrypt hash from plain text using the audited bcryptjs library, with an adjustable cost factor and a new random salt on every generation.
Cost / Salt Rounds: 10
Higher cost values are intentionally much slower to compute — that deliberate slowness is what makes bcrypt resistant to brute-force attacks.Bcrypt Hash
How to Use the BCrypt Hash Generator
Enter the plain text you want to hash and choose a cost (salt rounds) value from 4 to 12 — the default of 10 is a common real-world choice. Click Generate Hash to compute the bcrypt hash using the well-established bcryptjs library, entirely in your browser. Higher cost values take noticeably longer to compute; a loading indicator shows while the hash is being calculated.
Example
Hashing "correct horse battery staple" at cost 10 might produce a hash like $2b$10$abcdefghijklmnopqrstuv... — clicking Generate again produces a completely different hash string, even for the exact same input text.
Common Use Cases
- Learning how bcrypt password hashing works and experimenting with different cost factors.
- Generating a bcrypt hash for testing an authentication system during development.
- Comparing how much slower a higher cost factor makes hash computation.
FAQs
- Why use bcrypt instead of a general-purpose hash like SHA-256? Bcrypt is specifically designed for PASSWORD hashing — unlike general-purpose checksums like SHA-256 or CRC32, which are built to be fast, bcrypt is deliberately slow and has a built-in random salt baked into every hash. This combination makes brute-force and rainbow-table attacks far harder against bcrypt hashes than against a fast, unsalted hash.
- Why does clicking Generate produce a different hash every time, even with the same input? This is expected bcrypt behavior, not a bug — bcrypt automatically generates a new random salt each time you hash, and that salt is embedded directly in the resulting hash string. Two different hashes of the same password can both still be correctly verified against that same password.
- Is my text sent to a server? No — hashing happens entirely in your browser using the
bcryptjsJavaScript library. Nothing you type is uploaded anywhere.