Skip to content
Hash & IDs Server

bcrypt Generator

Hash a password with bcrypt, or verify one against a hash.

Query

Mode

Each step doubles the work. 12 is a good 2026 default.

Output

0 chars
Ctrl↵

        
Questions
Why does bcrypt need a server?
bcrypt is deliberately expensive and there is no browser-native implementation. This tool calls PHP's password_hash() on the server. Because your password is transmitted, treat any hash generated here as a demonstration: never paste a password you actually use.
What cost factor should I choose?
Pick the highest value your login endpoint can tolerate, targeting roughly 250ms per hash on production hardware. On 2026 servers that is usually 12 or 13. Cost is stored inside the hash, so you can raise it later and re-hash on next successful login.
Why is my long password truncated?
bcrypt only considers the first 72 bytes of input. Anything beyond that is ignored entirely, which is a real vulnerability if you assume otherwise. If you need longer inputs, pre-hash with SHA-256 and Base64 the result before passing it to bcrypt.