Bcrypt Generator — Hash & Verify Passwords Online, Free
Generate bcrypt hashes with a salt cost from 4 to 16 rounds, hash a whole list at once, and verify a plaintext against an existing hash.
About Bcrypt Generator
A bcrypt generator turns a password or string into a bcrypt hash — a deliberately slow, salted one-way value designed so that a stolen database cannot be turned back into passwords. The ZTools Bcrypt Generator runs bcryptjs entirely in your browser: choose a salt cost between 4 and 16 rounds, hash a single string or a whole list one-per-line, and verify any plaintext against a hash you already have. Because bcrypt generates a fresh random salt each time, hashing the same password twice produces two different hashes, and both still verify — that is the point of the algorithm, not a bug. Nothing you type is uploaded or logged.
Use cases
- Seeding a development or test database. Applications store bcrypt hashes, not passwords, so a seed file needs real hashes. Generate one for each test account at the same cost your application uses, paste them into your fixtures, and your login flow works locally without you ever having to run the app to create a user.
- Checking whether a password matches a stored hash. Paste an existing hash and the plaintext you think produced it to get a straight match or no-match answer. This is the fastest way to confirm a support report — that a specific password really does authenticate against a specific stored record — without adding logging to a production login path.
- Choosing a cost factor for your application. The cost is a work factor: each extra round roughly doubles the time to compute a hash, for attackers and for your login endpoint alike. Generating hashes at several costs on your own hardware shows you the real timing trade-off, so you can pick the highest cost your login latency budget tolerates rather than copying a number from a blog post.
- Migrating a list of accounts. The batch mode takes one string per line and returns a hash for each, so a set of temporary credentials for a migration or a workshop can be prepared in a single pass instead of one at a time.
How it works
- Set the salt cost. Drag the rounds slider between 4 and 16. The tool shows a speed indication for the value you pick, so the cost of the choice is visible before you commit to it.
- Enter what you want to hash. Type or paste a single string into the input field, or switch to the batch field and enter multiple strings one per line.
- Generate. bcryptjs runs in your browser and returns a complete bcrypt hash string, which embeds the algorithm version, the cost, and the random salt alongside the digest.
- Copy the result. Copy any generated hash straight into a seed file, a fixture, or a database record. Batch results are listed row by row against their inputs.
- Verify when you need to. Paste a hash and a candidate plaintext into the verify field to get a match or no-match answer, computed with bcrypt.compare rather than by re-hashing and comparing strings.
Examples
Input: Text: "correct horse battery staple" · Cost: 10
Output: $2a$10$… — a 60-character bcrypt string beginning with the version and cost.
The $2a$10$ prefix records the algorithm version and the cost, so a verifier never needs to be told which settings were used.
Input: The same password hashed twice at the same cost
Output: Two completely different hashes — and both verify against that password.
Each hash carries its own random salt. Identical hashes for identical passwords would be the security flaw bcrypt exists to prevent.
Input: Verify: hash "$2a$10$…" against "wrong password"
Output: No match.
Frequently asked questions
Is my password sent anywhere?
No. bcryptjs is bundled with the page and runs in your browser. There is no API call, no upload and no logging — you can confirm this by opening your browser network tab while generating a hash.
Why does the same password give a different hash every time?
bcrypt generates a new random salt for each hash and stores it inside the output string. Two hashes of one password will differ, and both will verify correctly. A scheme that produced identical hashes would let an attacker spot repeated passwords across a leaked database.
What cost factor should I use?
High enough that hashing is slow for an attacker, low enough that your login endpoint stays responsive. Generate at several costs here to see the real timing on your own hardware, then pick accordingly — the right number depends on your server, not on a universal default.
Can I get the original password back from a hash?
No. bcrypt is one-way by design. The only way to test a candidate password is to verify it against the hash, which is exactly what the verify field does.
Should I hash real production passwords here?
Hash test and development values. A password you actually use should be typed only into the service it belongs to — that is general good practice for any field on any site, regardless of what this page does with it.
Does bcrypt have a password length limit?
Yes. bcrypt only considers roughly the first 72 bytes of input, so text beyond that does not affect the hash. This matters if you are hashing long strings rather than typical passwords.
What is the difference between this and a SHA-256 hash?
SHA-256 is a fast general-purpose hash — being fast is a liability for passwords, because it makes brute-force guessing cheap. bcrypt is deliberately slow and salted. Use the Hash Generator for checksums and integrity, and bcrypt for passwords.
Pro tips
- The cost is stored inside the hash, so you can raise it for new passwords without breaking existing ones — re-hash each user at the new cost when they next log in successfully.
- Use batch mode to prepare an entire fixture set in one pass instead of generating hashes one at a time.
- When a hash from your database refuses to verify, check for whitespace copied along with it — a trailing newline is the single most common cause.
- Test at the cost your production application uses, not the default, or the timing you observe will not reflect what your users experience.
Reviewed by Ahsan Mahmood · Last updated 2026-07-25 · Part of ZTools.
For the full,
formatted version of this page, please enable JavaScript and reload
https://ztools.zaions.com/bcrypt.