Bcrypt Hash Generator — Generate Bcrypt Online

Generate secure bcrypt password hashes with configurable cost factors (4–31). All hashing is performed server-side with PHP's native bcrypt implementation. Never stored or logged.

Key Features

Generates industry-standard $2y$ blowfish password hashes
Configurable cost factor (work factor) from 4 to 31 (default 10 or 12)
Includes built-in verification tool to test passwords against existing hashes
Strict zero-logging policy: hashes and passwords are never retained

How to Use

Enter the plain-text password or string you want to hash.
Select your preferred cost factor (work factor, recommended 10-12).
Click "Generate Bcrypt Hash" to compute the hash.
Copy the resulting 60-character bcrypt hash string for your database.

Example

Sample input

mySecurePassphrase

Sample output

$2y$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy

Edge Cases

Cost factor changes hash length prefix only slightly
Empty password (allowed but unsafe)
Very long passwords truncated by bcrypt (72-byte limit)

Frequently Asked Questions

Why does bcrypt produce a different hash every time for the same password?

Bcrypt automatically generates a unique, cryptographically random salt for each hash operation. This prevents rainbow table attacks and credential matching.

What is the recommended cost factor for production?

A cost factor between 10 and 12 is recommended for modern web servers. It balances robust brute-force protection with reasonable server response times.

Can a bcrypt hash be decrypted back to the original password?

No. Bcrypt is a one-way cryptographic hash function. Hashes can only be verified by hashing an incoming password and comparing the results.

Related Tools

SRI Hash Generator — Subresource Integrity Online UUID Generator — Generate UUID v4 Online Free Random String Generator — Generate Secure Strings Online Base64 Encoder — Encode Text to Base64 Online

Privacy notice: when you run this tool, your input is sent over HTTPS to our server, processed in memory and returned. It is not stored or logged. Avoid pasting live secrets such as private keys or passwords.