OneFreePlace
TOOL #378 · BCRYPT HASH LAB

Bcrypt Hash Generator

Create production-compatible bcrypt password hashes with secure salts, understand the exact 72-byte boundary, inspect every hash component, benchmark cost on this device, and export test fixtures — all locally in your browser.

Secure random salts$2b$ / PHP $2y$72-byte safety guardLive cost benchmarkHash anatomyBatch fixturesNo network

Password & policy

0 UTF-8 bytes · bcrypt uses at most 720 characters
Type a password. This tool hashes exact UTF-8 bytes and never sends them anywhere.
2¹² = 4,096 setup rounds
Advanced deterministic salt — testing only
Ready.

Generated hash

Waiting
Prefix—
Cost—
Salt · 128 bit—
Digest · 184 encoded bits—

Batch fixture generator

Every row gets an independent cryptographic salt.
No batch generated yet.
#HashSaltTime
Generate a batch to inspect independent salts.

Calibrate bcrypt on this device

A good work factor is chosen from server measurements, not copied blindly. This browser benchmark shows relative cost and helps you understand doubling behavior; production authentication should be benchmarked on your actual backend.

CostRoundsMeasuredRelative
Run the benchmark to measure this browser.

Decision support

!
OWASP treats bcrypt as a legacy-compatible choice.
For new systems, prefer Argon2id when available. If bcrypt is required, use cost 10 or higher and enforce the 72-byte input limit.
✓
Each +1 cost approximately doubles work.
Cost 12 performs 4× the expensive setup work of cost 10.
✓
Use server latency budgets.
Tune against your own authentication infrastructure, concurrency, and abuse controls.

Why bcrypt is different

Bcrypt is a salted, adaptive password hash. The cost factor controls an exponential amount of work, while a fresh 128-bit salt prevents precomputed tables and makes identical passwords produce different stored hashes.

The 72-byte boundary

Bcrypt considers at most 72 bytes of password input. UTF-8 characters can use multiple bytes, so 72 characters is not the same as 72 bytes. This tool blocks generation above the limit by default instead of silently discarding data.

Modern password-storage guidance

For new applications, modern guidance favors memory-hard algorithms such as Argon2id. Bcrypt remains important for established stacks; when you use it, select a work factor your server can sustain and plan upgrades over time.

Prefix compatibility

$2b$ is the modern interoperable default. $2y$ is commonly emitted by PHP and uses corrected bcrypt behavior. $2a$ exists for older ecosystems and should be used only when compatibility requires it.

Production workflow

  • Generate a random salt for every password.
  • Store the full 60-character bcrypt hash.
  • Never encrypt passwords for later recovery.
  • Verify on the server and rate-limit login attempts.
  • Rehash after a successful login when your cost policy increases.

Privacy & limitations

Hashing happens in this browser with no network calls and no persistent password history. A browser utility is useful for development and interoperability testing, but your production application should hash passwords in its trusted backend runtime.

Node.js example

import bcrypt from 'bcrypt';\nconst hash = await bcrypt.hash(password, 12);\nconst ok = await bcrypt.compare(password, hash);

PHP example

$hash = password_hash($password, PASSWORD_BCRYPT, ['cost' => 12]);\n$ok = password_verify($password, $hash);\nif (password_needs_rehash($hash, PASSWORD_BCRYPT, ['cost' => 12])) { /* upgrade */ }