UsefulVerse
Language · English

Free to use, no account

Bcrypt Generator

Generate a standard bcrypt hash or check a password against an existing bcrypt hash. Work runs in a local browser worker, and the password is cleared after each check.

Bcrypt uses only the first 72 UTF-8 bytes. This tool rejects longer values rather than silently truncating them. Cost 8–14 increases work exponentially; higher costs can take longer, especially on phones. A local worker keeps the page responsive, but your device performs the work.

Use a test password, not a real login password. The result is for learning and compatibility checks; do not use this browser page as a production account-storage system.

Paste a standard 60-character bcrypt hash. Verification supports bcrypt costs 4–14; unusually high-cost hashes are declined to avoid unbounded work on your device.

What does a bcrypt hash do?

Bcrypt is a password-hashing function, not encryption. It combines a one-way hash with a random salt and a configurable work factor. A hash can be checked against a candidate password but cannot be decrypted to reveal the original.

Frequently asked questions

What does a bcrypt hash do?

Bcrypt is a password-hashing function, not encryption. It combines a one-way hash with a random salt and a configurable work factor. A hash can be checked against a candidate password but cannot be decrypted to reveal the original.

Are my password or hash uploaded or saved?

No. Hashing and verification run in this browser. The page does not send the entered password or hash to a server or save them; the password field is cleared when the operation finishes. For safety, use a test password rather than a real account password.

Does bcrypt encrypt my password?

No. Bcrypt is a one-way password hash, not reversible encryption. It is designed to let software check a candidate password without storing the original password.

Why does bcrypt have a 72-byte limit?

The bcrypt format processes at most 72 UTF-8 bytes. This tool refuses longer input so different passwords are never silently treated as the same truncated value.

Should I store this hash for a real account?

Do not use this page as a production credential system. Real services should hash passwords on their trusted server with maintained authentication libraries, suitable parameters, rate limits and account protections.