4 (fastest)
8 (balanced)
12 (slowest)
Recommended
~100ms per hash
Ready to hash
Enter a password and click Generate// generate secure bcrypt hashes with cost factor
Generate secure bcrypt hashes with configurable cost factor. Verify passwords against bcrypt hashes instantly. Browser-based, free, no signup required.
Ready to hash
Enter a password and click GenerateType or paste the password you want to hash (max 72 chars for bcrypt).
Drag the slider to choose a cost factor between 4–12. Higher = slower but more secure.
Click Generate Hash, then copy the result to use in your application.
Bcrypt is an adaptive password hashing algorithm designed to be computationally expensive and resist brute-force attacks. The cost factor controls how slow the hashing is — higher values exponentially increase computation time, making rainbow table attacks infeasible.
Cost factor 10 is the recommended default for most web applications. It produces a hash in roughly 100ms on modern hardware — slow enough to resist brute-force attacks but fast enough for user login. For high-security applications, use 12. Avoid anything below 8 in production.
Bcrypt internally truncates input to 72 bytes before hashing. Passwords longer than 72 characters produce the same hash as their first 72 characters, which is a security concern. Our tool warns you when input exceeds this limit.
Yes — bcrypt hashing requires PHP's password_hash() function which runs server-side. However, no passwords or hashes are logged, stored, or transmitted beyond the single request. The connection is HTTPS-encrypted.
The prefix identifies the algorithm and version: $2y$ is PHP's bcrypt variant (equivalent to $2b$ in other languages). The next segment is the cost factor, followed by the 22-character salt, then the 31-character hash digest.
Yes. The full 60-character string (including prefix, cost, salt, and digest) is the complete bcrypt hash. Store it in a VARCHAR(60) or TEXT column. To verify, use password_verify($input, $storedHash) in PHP or equivalent in your language.
Bcrypt automatically generates a random 22-character salt for each hash. This means two hashes of the same password will look completely different, which prevents rainbow table lookups. The password_verify() function extracts the salt from the stored hash automatically.
A bcrypt hash generator is a tool that takes a plain-text password as input and produces a secure, one-way cryptographic hash using the bcrypt algorithm. Bcrypt was designed in 1999 by Niels Provos and David Mazières specifically for password hashing — unlike general-purpose hashing algorithms like MD5 or SHA-256, bcrypt is intentionally slow and computationally expensive, making it resistant to brute-force and dictionary attacks.
This free online tool lets you generate bcrypt hashes instantly using PHP's native password_hash() function with the PASSWORD_BCRYPT constant. You can also verify whether a plain-text password matches an existing bcrypt hash — useful for debugging authentication logic during development.
💡 Looking for premium web development assets? MonsterONE offers unlimited downloads of templates, UI kits, and security-focused admin panels — worth checking out.
Bcrypt uses the Blowfish cipher's key setup algorithm (EksBlowfishSetup) to derive a hash from a password. The process involves three steps:
2^cost — at cost 10, that's 1,024 iterations.The resulting hash string looks like: $2y$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy
The cost factor (also called the work factor or rounds) is the most important parameter when generating bcrypt hashes. It controls how computationally expensive the hashing operation is:
The key insight is that the cost factor is adaptive. As hardware gets faster, you can increase the cost factor to keep bcrypt hashing approximately the same wall-clock time. This is why bcrypt remains secure even decades after its invention.
Many developers mistakenly use fast hashing algorithms for passwords. Here's why bcrypt is superior for password storage:
PASSWORD_ARGON2ID. For new projects, prefer Argon2id over bcrypt.PHP makes bcrypt hashing trivial with the password_hash() and password_verify() functions introduced in PHP 5.5:
// Hash a password
$hash = password_hash($password, PASSWORD_BCRYPT, ['cost' => 10]);
// Verify a password
if (password_verify($input, $storedHash)) {
// Password is correct
}
// Check if rehashing is needed (e.g., after increasing cost)
if (password_needs_rehash($storedHash, PASSWORD_BCRYPT, ['cost' => 12])) {
$newHash = password_hash($password, PASSWORD_BCRYPT, ['cost' => 12]);
// Store $newHash in database
}Even with a good algorithm, implementation errors can undermine security:
password_needs_rehash(): As you increase your cost factor over time, you should rehash stored passwords on next successful login.Bcrypt is one part of a comprehensive password security strategy. Combine it with: