Runs entirely in your browser: your input, the HMAC key and the expected hash never leave this device.
Why bcrypt exists for passwords
bcrypt is a password-hashing function built for slowness. It generates a random salt for every password and repeats the Blowfish key schedule 2^cost times, so the cost β the rounds shown here β can be raised as hardware gets faster. A result looks like $2b$12$... with the version, cost and salt embedded. Because the salt is random, hashing hunter2 twice produces two different but equally valid strings, and both verify against the same password.
Use bcrypt whenever you store user passwords, and prefer it over SHA-256, which is far too fast β GPUs compute billions of SHA-256 hashes per second, while a bcrypt cost of 12 costs about a quarter of a second per attempt and scales with the cost setting. Tune the cost so a single hash takes roughly 100 to 250 ms on your server, then compare the candidate password with the stored hash using a constant-time verify.
How to use the bcrypt generator
- Type the password to hash and generate the bcrypt digest.
- Raise or lower the cost (rounds) to match your server's budget.
- To check a password, paste an existing $2 hash into the verify field.
- Copy the full hash β the salt is stored inside it.
Frequently asked questions about bcrypt
Why does the same password give a different hash?
bcrypt draws a fresh random salt each time and stores it in the output, so every hash is unique even for identical passwords.
When is bcrypt better than SHA-256?
Always for passwords. bcrypt is intentionally slow and salted, which makes brute force and rainbow tables impractical; SHA-256 is designed to be fast.
Is bcrypt computed here as fast as on a server?
No. This page runs bcrypt in JavaScript, so it is slower than a native implementation β useful for demonstrating and verifying, less so for bulk generation.
Runs entirely in your browser: your input, the HMAC key and the expected hash never leave this device.
