Bcrypt Hash & Verify

Hash passwords with bcrypt and verify hashes — using bcryptjs, entirely in your browser.

Client-side

About this tool

Bcrypt is the industry-standard password hashing algorithm for web applications. Unlike SHA-256 or MD5 (which are fast and can be brute-forced), bcrypt is intentionally slow due to its configurable cost factor (the number of key-expansion rounds). A cost factor of 10 means 2^10 = 1,024 rounds; factor 12 means 4,096 rounds.

This tool uses the bcryptjs library — a pure-JavaScript implementation that runs in the browser without any server. You can hash a password and get the bcrypt string (which includes the salt and cost factor), or verify whether a plain-text password matches a stored hash. The same algorithm is used by password_hash() in PHP, BCrypt in Spring Security, and the bcrypt package in Node.js.

Note: bcrypt is slow by design. Higher cost factors (12–14) are more secure but take longer to compute. Factor 10 is the practical minimum for production; factor 12+ is recommended for modern hardware.

FAQ

Why is bcrypt preferred over SHA for passwords?

SHA is extremely fast, allowing attackers to test billions of passwords per second with GPUs. Bcrypt is designed to be slow (and configurable), limiting attacks to hundreds or thousands per second.

What does the cost factor mean?

The cost factor (4–31) controls how many rounds of key expansion run. Each increment doubles the time. Factor 10 = ~100ms, factor 12 = ~400ms on typical hardware. Higher = more secure but slower login.

Does the tool send my password anywhere?

No. bcryptjs runs entirely in the browser using JavaScript. Your password never leaves your tab. Open your browser's Network panel to verify there are zero outbound requests.