Bcrypt Generator and Verifier
Generate a salted $2b$ hash, or verify a password against a supported $2a$, $2b$, or $2y$ hash. Inputs remain in this page.
Use a trusted page and device. Passwords must be nonempty and at most 72 UTF-8 bytes; a character may use several bytes. Longer passwords are rejected, not truncated.
Higher costs take longer. Verification also rejects hashes outside cost 04–15.
Enter a password to generate or verify a hash.
Hash generation elapsed time
Match result
Passwords and hashes use page memory only; no storage or upload. One operation runs at a time. Editing, clearing, or navigation discards the result but cannot abort bcrypt work already started.
A QUICK WALKTHROUGH
How to use this tool
- Enter a nonempty password of at most 72 UTF-8 bytes.
- Choose cost 4–15 to generate, or paste a complete bcrypt hash with cost 04–15 to verify.
- Review the hash or true/false match result. Copy the generated hash or clear the page when done.
Cost and format limits
Both generation and verification accept cost 4–15. Verification requires a canonical 60-character $2a$, $2b$, or $2y$ bcrypt hash. Higher costs take longer; out-of-range costs and malformed hashes produce an error.
UTF-8 password boundary
Passwords must contain 1–72 UTF-8 bytes. A character can use several bytes. Longer passwords are rejected, so this page never silently truncates them. Whitespace is preserved.
Local asynchronous processing
bcryptjs 3.0.3 performs one asynchronous operation at a time. Editing or clearing invalidates the result, but does not abort library computation. Controls remain busy until that work finishes. Passwords and hashes use only page memory; no storage or upload is used. This is a calculation tool, not production authentication. The page shows elapsed milliseconds for the current hash generation, not a benchmark.
GOOD TO KNOW
Common questions
What does false mean?
The supplied password did not match a syntactically supported hash. Invalid input or computation failure is shown separately as an error.
Can work be stopped immediately?
No. Editing, clearing, or navigation prevents an old result from appearing; already-started bcrypt work finishes internally.
Why do generated hashes differ?
Generation uses a random salt, so the same password and cost can produce different valid hashes.