100% free · Real bcrypt, hashed in your browser · No signup needed
Privacy: everything happens in your browser — this page bundles the open-source bcrypt.js library (Apache 2.0), so your password never leaves this device. Nothing is sent, stored or logged. Bcrypt hashes embed the algorithm, cost and salt — e.g. $2a$10$… — so the same password gives a different hash every time, and PHP''s password_verify accepts them directly. Never store plain-text passwords; store only the hash and check logins with password_verify.
Bcrypt is an adaptive password-hashing function created by Niels Provos and David Mazières in 1999 and built on the Blowfish cipher. Unlike fast general-purpose hashes such as MD5 or SHA-256, which are engineered to compute as quickly as possible, bcrypt is deliberately slow: it runs its internal key schedule thousands of times so that brute-force guessing becomes impractical even with powerful modern hardware. That intentional slowness, combined with a built-in random salt for every hash, is exactly why bcrypt has remained the gold standard for password storage for more than two decades.
Here is the rule every developer must internalize: NEVER store plain passwords. If your database leaks and passwords are sitting there in cleartext, every account on your site — and every other site where your users reused the same password — is compromised instantly. Store only the hash, and when a user logs in, verify the password they typed against the stored hash. PHP makes this remarkably easy with its native functions: password_hash creates the hash and password_verify checks a candidate password against it. Our free Bcrypt Hash Generator gives you both sides of that workflow in a single page.
Using the tool is straightforward. Type or paste a password into the password field, choose a cost factor between 4 and 12 (the default is 10), and click Generate. Your password is hashed entirely inside your browser by a bundled open-source bcrypt library implementing the exact algorithm PHP's password_hash uses — nothing is sent to any server, so the password never leaves this page. It is never stored, logged, or retained in any way. The resulting hash is displayed in full, ready to copy into your application or database.
Below the generator you will find a verify box. Paste any bcrypt hash into it, type a candidate password, and the tool will tell you whether they match — the online equivalent of PHP's password_verify. This is perfect for learning and testing: generate a hash, confirm that the correct password verifies, then type a wrong password and watch it get rejected. Seeing both outcomes side by side builds real confidence that your login logic will behave correctly.
One honest note: hashing happens 100% in your browser, using the well-tested open-source bcrypt.js library — the same Blowfish-based algorithm PHP's password_hash uses, so the hashes it produces verify directly with PHP's password_verify. Your password never leaves this page: there is nothing to intercept and nothing retained.
A bcrypt hash looks like this: $2a$10$...................... — a long string that begins with the prefix $2a$10$. Every part of that prefix carries meaning. Bcrypt hashes are self-describing: they embed the algorithm identifier, the cost factor, and the random salt right alongside the derived key, so verification needs nothing but the hash string itself. You never have to store the salt separately, which is one of bcrypt's great practical advantages.
The $2a$ segment identifies the bcrypt algorithm variant — PHP's password_verify accepts $2a$ hashes interchangeably with its own $2y$ output, so hashes from this tool drop straight into any PHP application. The $10$ is the cost factor you selected in the tool. The cost factor is an exponent: cost 10 means 2^10, or 1,024, rounds of the internal key schedule. Raise the cost to 11 and the work doubles; raise it to 12 and it quadruples. Higher cost means slower hashing, which means a brute-force attacker needs proportionally more computing power to test guesses. That scaling behavior is the adaptive part of adaptive hashing: as computers get faster over the years, you simply raise the cost to keep pace, and old hashes can be transparently upgraded the next time each user logs in.
The characters after the prefix contain the 128-bit salt, randomly generated fresh for every single hash, followed by the derived key itself. Because the salt is unique per hash, attackers cannot use precomputed rainbow tables — every guess must be recomputed against the individual salt.
The tool offers a cost selector from 4 to 12, with 10 as the default. Cost 10 is the long-standing default and the right choice for most web applications: it takes roughly a second in a modern browser — imperceptible during login but brutally expensive for an attacker attempting billions of guesses. Lower costs from 4 to 8 are useful for automated test suites, where thousands of hashes are generated and speed matters more than security. Higher costs of 11 and 12 suit high-security scenarios where you are willing to trade a few hundred milliseconds of login time for stronger protection.
The guiding principle: use the highest cost that still keeps logins feeling instant — roughly 100 to 300 milliseconds per hash. PHP's password_needs_rehash helper detects outdated hashes, so you can automatically re-hash at a stronger cost the next time each user signs in.
Building a login system, membership area, or client portal? Every serious web project needs secure, reliable hosting behind it. FistHost's shared hosting plans start at just $0.99/month and include PHP with all native functions enabled — password_hash and password_verify work right out of the box with nothing to install or configure. Choose the annual plan and you will also receive a FREE domain name, so your secure application launches under its own professional brand from day one.
Developers sometimes ask why they should not simply hash passwords with SHA-256, especially since our SHA-256 Hash Generator exists for general-purpose hashing. The answer is purpose. SHA-256 is designed to be fast — ideal for checksums, terrible for passwords, since an attacker with a graphics card can try billions of guesses per second. Bcrypt is deliberately slow and salted, purpose-built for protecting human-chosen secrets. Before you hash anything, it also pays to make sure the password itself is strong — run it through our Password Strength Checker, or create a robust one from scratch with our Password Generator.
Security does not stop at hashing. FistHost includes free SSL on every hosting plan, so the HTTPS encryption that protects your users' passwords on their way to your server is always active on your own site too. With fast servers, one-click application installs, and support that understands PHP development, FistHost gives your project a secure, dependable home for just $0.99/month — a small price for the peace of mind that your users' credentials are handled the right way.
Yes. Bcrypt remains a recommended password-hashing function, backed by decades of cryptanalysis and universal framework support — a completely defensible choice for any new project.
Effectively never. Every hash gets a fresh random salt, so identical passwords produce completely different hash strings. That is a feature, not a bug — it is what defeats rainbow-table attacks.
No. Hashing is one-way by design. The only way to attack a bcrypt hash is to guess passwords and check them, and the cost factor makes each guess expensive. Combine bcrypt with long, unique passwords and the attack becomes infeasible.
In your user table, in a VARCHAR(255) column to leave room for future algorithms. Never store hashes in logs, URLs, or cookies, and never email them.
No. Your password never leaves this page — it is hashed inside your browser by the bundled bcrypt library and discarded immediately. Nothing is written to disk, to a database, or to any log, and nothing is ever transmitted to a server.
No reviews yet. Be the first to review this tool!
Reviews are protected by captcha and moderated before they appear.