Generate a bcrypt hash from any plaintext, or check whether a plaintext matches a hash you already have. Pick a cost factor between 10 and 14 to balance strength against how long hashing takes. Everything runs inside your browser on a background thread, so the plaintext never leaves your device.
This tool does not use any data storage or network traffic.
Bcrypt is a deliberately slow, salted hash built for passwords: every hash gets its own random salt, so the same plaintext never produces the same string twice. A higher cost factor doubles the work per step, making the hash stronger to crack and slower to compute.
This tool needs a modern browser with Web Worker support, so hashing can run without freezing the page.
Generate
Verify
About the $2y$ prefix
Hashes here start with $2y$. That marker, $2a$ and $2b$ all mean the same algorithm — each one just records which historical implementation bug a hash is known not to be affected by. The digest is identical either way.
It matters because PHP is the odd one out. Its password_get_info() only reports a hash as bcrypt when it starts with $2y$ — for $2a$ or $2b$ it says “unknown”, even though password_verify() accepts all three quite happily. Laravel checks that name before it verifies anything, so a $2b$ hash makes Hash::check() throw “This password does not use the Bcrypt algorithm” — a 500 error rather than a rejected login. Every other ecosystem accepts $2y$ without complaint, so it is the portable choice.
Verification above accepts any of the three, so a hash generated elsewhere can still be checked here.