Bcrypt Hash / Verify
Hash a password with bcrypt, or verify that a password matches an existing bcrypt hash. Bcrypt is the recommended algorithm for password storage because it's slow by design — the cost factor controls how many iterations the hashing function runs, making brute-force attacks expensive. You can adjust the cost factor from 4 to 31.
What it does
- ▸Hashes text using bcrypt with a configurable cost factor (4-31)
- ▸Verifies whether a plaintext password matches a given bcrypt hash
- ▸Generates a new random salt for each hash automatically
- ▸Shows the full bcrypt hash string including the algorithm, cost, salt, and hash
Use cases
- ▸Generating a bcrypt hash for a user password during registration
- ▸Verifying a password against a stored bcrypt hash during login testing
- ▸Testing different cost factors to balance security and performance
- ▸Migrating from MD5/SHA password hashes to bcrypt
How it works
For hashing: paste your password, set the cost factor, and click hash
The tool generates a random salt and computes the bcrypt hash
For verifying: paste the password and the bcrypt hash, and click verify
The tool reports whether the password matches the hash
Frequently asked questions
1What cost factor should I use?
A cost factor of 10-12 is standard for most applications. Each increment doubles the computation time. Choose the highest cost that your users can tolerate during login (typically under 500ms). Increase it over time as hardware gets faster.
2Why is bcrypt better than SHA-256 for passwords?
Bcrypt is deliberately slow and includes a salt, which makes it resistant to rainbow table attacks and brute-force attacks. SHA-256 is fast — which is good for file hashing but bad for passwords, because an attacker can try millions of passwords per second.
3Can I use this to migrate existing password hashes?
Yes. If you're migrating from another hash algorithm, you can generate bcrypt hashes for your users' passwords. For a zero-downtime migration, hash with bcrypt on next login and store the new hash, falling back to the old hash until then.
Related tools
Hash Generator
MD5 / SHA / CRC32 / Blake hashes and HMACs of the input text
htpasswd Generator
Generate htpasswd entries with bcrypt, apr1 (Apache MD5), or SHA1 hashing
Password Strength
Estimate password entropy, weaknesses and crack time
Stateless Password Generator
Derive deterministic passwords from a master secret and site name — same inputs always produce the same password
Use Bcrypt Hash/Verify offline in Devinity
All 95 tools run locally on your Mac. No internet required, no data sent to servers.
Download Devinity →