FREE DEVELOPER TOOLS
Generate secure bcrypt password hashes directly in your browser. Nothing is sent to any server.
Bcrypt automatically generates and embeds a random 128-bit salt into every hash, so two bcrypt hashes of the same password are always different. The work factor (cost) controls how computationally expensive the hash is — doubling with each increment. Work factor 12 requires 212 = 4,096 iterations, making brute-force attacks roughly 100,000× slower than MD5.
The output string encodes everything needed to verify a future password: the bcrypt version, the work factor, the salt, and the hash — all in a single 60-character string that you store in your database.
Version · Cost · Salt (22 chars) · Hash (31 chars)
| Use case | Bcrypt? | Notes |
|---|---|---|
| Web app user passwords | ✅ Excellent | Standard choice — embedded salt, configurable cost |
| API keys / tokens | ⚠️ Not ideal | Use SHA-256 HMAC or a dedicated token store instead |
| File checksums | ❌ Wrong tool | Use SHA-256 or BLAKE3 — bcrypt is intentionally slow |
| Database password column | ✅ Excellent | Never store plain or MD5/SHA-1 hashed passwords |
| PIN / short passwords | ✅ Good | 72-byte limit is not an issue for PINs |