Loading Bcrypt Tool...
Securely generate and verify bcrypt password hashes. Adjust cost factors to balance security and performance. All operations are performed securely on the server.
Higher cost means more computational work, making the hash harder to brute-force but slower to generate.
Generate a hash to see results
Bcrypt is a password-hashing function designed by Niels Provos and David Mazières, based on the Blowfish cipher. Unlike fast hashing algorithms like MD5 or SHA-256, bcrypt is intentionally slow and computationally expensive. This property, known as "key stretching," makes it resistant to brute-force attacks and rainbow table lookups.
The cost factor determines the number of iterations the algorithm runs (2cost). A cost of 10 is the current standard default, meaning 210 (1,024) iterations. Increasing the cost by 1 doubles the time it takes to compute the hash.
bcryptjs or argon2.Yes, bcrypt remains a very secure choice for password hashing. While newer algorithms like Argon2 are memory-hard (resistant to GPU/ASIC attacks), bcrypt is still widely recommended and secure when used with an appropriate cost factor.
Existing hashes created with a lower cost factor remain valid. When a user logs in, you can detect the old cost, verify the password, and then re-hash it with the new higher cost to seamlessly upgrade security.
No. Hashing is a one-way function. You cannot retrieve the original password from the hash. You can only verify if a candidate password matches the hash.