bcrypt hash generator and checker

What it does

bcrypt is a password hash: it salts each password and is deliberately slow, so a leaked hash takes a long time to guess. The cost factor sets the slowness; each increase doubles it.

A bcrypt hash such as $2b$12$… stores the version, cost, salt and hash together, so verifying needs only the hash and the password.

How to use it

1. To hash: enter a password, choose a cost and generate.
2. To verify: paste an existing hash and the password and check.
3. Copy the hash into your database or config.

Things to watch for

• bcrypt only uses the first 72 bytes of a password. Longer input is cut off silently, and the tool warns when that happens.
• High costs take seconds in a browser. Cost 12 is a common production setting.
• The same password gives a different hash every time because the salt is random. Compare with Verify, not by eye.

Questions

What is the difference between $2a$, $2b$ and $2y$?

They are the same algorithm. $2b$ fixed a rare bug in the OpenBSD code and $2y$ is PHP and Apache’s name for the fixed version. Verification accepts all three.

What cost should I use?

Choose the highest cost that keeps a login under about 250 ms on your server. 10 to 12 is typical.

Is bcrypt still recommended?

Yes. Argon2id is the newer recommendation from OWASP, but bcrypt remains acceptable and is far better than MD5 or SHA.

Is my password uploaded?

No. Hashing runs in your browser.