Guide
Creating and checking bcrypt password hashes
bcrypt, designed by Niels Provos and David Mazières in 1999, is one of the oldest password hashes still in daily use. It is built on the Blowfish cipher and is deliberately slow, with a cost setting that lets you keep it slow as computers speed up. Frameworks such as Rails, Laravel, Django and Spring offer it by default. This page makes bcrypt hashes for test data and checks whether a password matches an existing hash.
What a bcrypt string contains
A hash looks like $2b$12$ followed by 53 characters. The first part names the version, 2b. The two digits after it are the cost, the base-2 logarithm of the number of rounds, so 12 means 4,096 rounds of the key setup. The next 22 characters are the 128-bit salt and the last 31 are the hash itself. Everything needed to verify a password is in the string, which is why databases store one column.
Creating a hash
Type a password, pick a cost and press the create button. The cost list runs from 4 to 14 with the number of rounds beside each: “10: 1024 rounds”, “12: 4096 rounds (a good default)”, and costs below 10 are marked too low for real use. The page prints the hash and how many milliseconds it took. The Sample button fills the password U*U and cost 10, and the result changes on every press because the salt is random.
Verifying a hash
Switch to “Check a password against a hash”, paste a hash and a password and press Check. The sample for this tab loads the well-known test vector from the Openwall crypt library: the password U*U and the hash $2a$05$CCCCCCCCCCCCCCCCCCCCC.E5YPO9kmyuRGyh0XouQYb4YMJKvyOeW. The page answers “The password matches this hash.” Edit one character and it says the password does not match.
Choosing the cost
OWASP’s guidance is a cost of at least 10, and the usual advice is to choose the highest value that keeps a login under roughly 250 milliseconds to one second on your server hardware. Because the cost doubles the time per step, a cost of 14 takes sixteen times as long as 10. Measure in your own environment, since a browser is slower than a native library.
The 72-byte limit
bcrypt uses the first 72 bytes of its input. Longer passphrases are truncated silently, so two long passwords that agree for 72 bytes produce the same hash. Some systems avoid this by hashing the password with SHA-256 and encoding the digest before bcrypt; this page does not, so a hash made here should match only plain bcrypt. Multi-byte characters count as several bytes.
Limits
Do not enter real passwords: the work is local and nothing is saved, but a password you use should never be typed into a website. bcrypt needs little memory, so GPUs attack it better than they attack memory-hard functions such as Argon2id or scrypt.
Related tools
- PBKDF2 and HKDF Calculator covers another standard password-stretching function.
- Password Strength Checker shows how long a password would last against guessing.
- Hash Identifier recognises bcrypt strings and other hash formats.
- Password Generator makes strong random passwords.
Checked against the current version of the Bcrypt Generator on .