JWT Decoder
Decode and debug JSON Web Tokens, see when they expire, and verify HS, RS, PS, ES, and EdDSA signatures.
Bcrypt Generator & Verifier
Hash passwords with bcrypt and verify passwords against existing hashes. Free, private, and 100% in your browser.
Passwords are hashed in your browser and never leave this page.
Generate a bcrypt Hash
Verify a Password
What Is bcrypt?
bcrypt is a password hashing function designed in 1999 by Niels Provos and David Mazières, based on the Blowfish cipher. Unlike fast hashes such as MD5 or SHA-256, bcrypt is intentionally slow and salted, which makes brute-force and rainbow-table attacks impractical. It remains one of the most widely deployed password hashing algorithms.
$2b$12$R9h/cIPz0gi.URNNX3kh2OPST9/PgBkqquzi.Ss7KIUgO2t0jWMUW
\__/\_/\____________________/\_____________________________/
alg cost salt (22 chars) hash (31 chars)Features
Generate bcrypt hashes
Hash any password with a fresh random salt and a cost factor from 4 to 18.
Verify passwords
Check whether a password matches an existing bcrypt hash from your database or config.
Hash breakdown
See the version, cost, salt, and hash parts of any bcrypt string, with clear errors for malformed hashes.
Compatible output
Hashes work with PHP password_verify, Node.js bcrypt and bcryptjs, Spring Security, Django, Go, and Ruby.
Responsive while hashing
Hashing runs in small slices with a progress bar and a Cancel button, so the page never freezes.
Private by design
Passwords are hashed locally in your browser. Nothing is sent to a server.
How to Generate and Check a bcrypt Hash
- Enter a password, choose a cost factor (10 or 12 is typical), and click Generate Hash.
- Copy the 60-character hash into your database seed, fixture, or config file.
- To check a password, enter it with the stored hash under Verify a Password and click Verify Password.
- Use Test in Verifier to confirm a freshly generated hash in one click.
Frequently Asked Questions
Is it safe to enter a password here?
Yes. The bcrypt hash is computed in your browser with JavaScript; passwords and hashes are never sent anywhere. For real production passwords, the safest option is still to hash them inside your own application.
Which cost factor should I use?
Pick the highest cost your server can handle while keeping logins fast, typically 10 to 12 in 2026. Each step doubles the work. OWASP recommends a minimum of 10. Test on your production hardware: a single hash should take roughly 100 to 300 milliseconds.
Why is the hash different every time for the same password?
bcrypt generates a new random 16-byte salt for every hash and stores it inside the hash string. That is why two hashes of the same password differ, and why verification still works: the salt is read back from the hash.
What is the difference between $2a$, $2b$, and $2y$?
They are the same algorithm. $2b$ is the current OpenBSD version, $2y$ is the PHP name for the fixed implementation, and $2a$ is the older label still used by many libraries. For passwords up to 72 bytes they produce identical results, so most libraries accept all three.
Is there a password length limit?
Yes. bcrypt only uses the first 72 bytes of the password. Longer passwords are truncated, so two long passwords with the same first 72 bytes produce the same hash. The tool warns you when a password exceeds the limit. Note that non-ASCII characters take 2 to 4 bytes each.
Can a bcrypt hash be decrypted?
No. bcrypt is a one-way function. The only way to find the password is to guess it, and the cost factor makes each guess deliberately slow.
Related Tools
JWT Encoder
Create and sign JSON Web Tokens with HS256, RS256, ES256, PS256, or EdDSA, and generate test key pairs.
Hash Generator
Generate MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes and HMACs of text or files, live as you type.
UUID Generator
Generate v4, v7, v1, v5, and v3 UUIDs / GUIDs in bulk, and inspect any UUID's version and timestamp.