Bcrypt Hash Generator / Verifier

The Bcrypt Hash Generator / Verifier hashes a password using bcrypt, or checks a password against an existing bcrypt hash to see if it matches — the two operations any application needs when storing and later checking passwords securely.

It's used for generating a bcrypt hash to manually insert into a database while seeding test accounts, verifying that a password reset or migration script produced the hash you expect, checking whether a known password matches a hash found during debugging (with appropriate authorization — never on credentials you don't own), and simply understanding how bcrypt's cost factor and salt actually work by experimenting with real hashes.

Bcrypt is a purpose-built password hashing algorithm — not a general-purpose hash like SHA-256 — designed to be deliberately slow and configurably expensive via its 'cost factor' (rounds), which controls how many times the underlying algorithm iterates. Each hash embeds its own randomly generated salt and the cost factor used, which is why two bcrypt hashes of the identical password always look completely different, and why verification needs no separate salt storage — everything required to check a password is self-contained in the hash string itself (the `$2b$10$...` format identifies the algorithm variant, cost factor and salt inline).

Higher cost factors make brute-force attacks proportionally slower but also make legitimate hashing slower, so real applications pick a cost factor that's deliberately expensive relative to their server hardware — commonly 10-12 as of the mid-2020s, increasing over time as hardware gets faster. This tool caps the cost factor at 12 to keep the browser responsive; production systems sometimes go higher. All hashing and verification run entirely client-side using the same bcrypt algorithm implementation used server-side in countless applications — no password you type here is ever transmitted anywhere.