Online bcrypt Hash Generator
Understanding bcrypt
bcrypt is a password-hashing function. Its encoded output contains the version prefix, cost, random salt and digest, for example $2y$12$…. Hashing the same password twice should therefore produce different strings.
Primary useVerifiable password storage
Encoded parametersVersion, cost, salt and digest
Generation and database lookup
Use the generator to create a bcrypt hash or inspect its format. Applications do not “decrypt” bcrypt; they verify a candidate password with a function such as password_verify.
Security guidance
Choose a cost high enough to slow guessing while remaining acceptable for your server, and review it over time. Store the complete bcrypt string because it contains every parameter needed for verification.
FAQ
Why does the same password produce different bcrypt hashes?
bcrypt generates a random salt for every hash. Verification reads the salt and cost from the complete encoded string.
Can bcrypt be decrypted?
No. An application checks a candidate password against the hash; it does not recover the original password.
What does the bcrypt cost mean?
The cost controls the work factor. Higher values make hashing and password guesses slower.
Practical notes
bcrypt stores its salt and cost in the complete encoded string. Verification checks a candidate without recovering the original password.
Verificationpassword_verify
Limit72 bytes
BenchmarkMeasured server time
Frequently asked questions
Why do two bcrypt hashes differ?
A random salt is generated for every calculation.
What happens after 72 bytes?
Classic bcrypt only processes the first 72 input bytes.
Which cost should be selected?
Measure it on your server and use the highest cost compatible with your load and latency target.