bcrypt Hash Generator
Hash a password with bcrypt at the cost you choose, or check a password against an existing $2y$ or $2b$ hash, entirely in your browser.
Free · No sign-up · Your inputs stay in your browser
Input
Generate and verify bcrypt hashes
Output
bcrypt
The output carries everything needed to check it: $2y$ is the variant (PHP writes 2y, others 2b; they are the same algorithm), then the cost, a 22-character salt and the 31-character hash. password_hash() and Hash::make() produce exactly this, so a hash made here verifies with password_verify(). Choose the highest cost your login endpoint can afford, around 100-250 ms on the server.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
Choosing the cost
Each step in cost doubles the work for you and for anyone guessing passwords offline. Laravel's default is 12; pick the highest value your login endpoint can afford, roughly 100 to 250 ms on the production server. The hash stores its cost, so you can raise it later and rehash on the next successful login (Laravel's Hash::needsRehash does the check). OWASP's Password Storage Cheat Sheet covers bcrypt alongside Argon2id.
The 72-byte limit
bcrypt only uses the first 72 bytes of the password, so two long passphrases that share a prefix produce the same hash. Multi-byte characters reach the limit sooner. Argon2id has no such limit.