What is bcrypt and why is it used for passwords?

Bcrypt is a password-hashing function designed to be slow and computationally expensive, making brute-force attacks impractical. Unlike fast hashes like SHA-256, bcrypt includes a configurable cost factor that controls how many iterations are run — the higher the cost, the longer it takes to compute, which protects passwords even if an attacker obtains the hash database.

What algorithm does this tool actually use?

This tool uses PBKDF2-HMAC-SHA256 via the browser's built-in Web Crypto API. The output is wrapped in bcrypt's recognisable $2b$ $ prefix so the format is immediately familiar to developers. PBKDF2 is equally secure to bcrypt — it is standardised by NIST and used in many production systems.

What cost factor (rounds) should I choose?

Cost 10 is the widely recommended default for most applications — it takes roughly 100–300 ms to compute, which is fast for a login check but painfully slow for bulk cracking. Cost 12 gives stronger protection at the expense of ~1 s per hash. Avoid cost 4–6 for production passwords; those are only useful for testing.

Is it safe to use this tool with real passwords?

Yes. All processing happens entirely inside your browser using the Web Crypto API. No input is sent to any server, no data is logged, and the page works completely offline once loaded.

Can I verify a hash generated by a real bcrypt library?

The verify tab can only verify hashes that were generated by this same tool, because it uses PBKDF2 internally rather than the true bcrypt algorithm. To cross-check hashes from libraries like bcrypt.js or Python's passlib, you would need a server-side environment.

Generateur de hachage Bcrypt

Generez et verifiez des hachages de mots de passe au format bcrypt dans votre navigateur avec PBKDF2-SHA256.

Cet outil utilise PBKDF2-HMAC-SHA256 (Web Crypto API) avec un format de sortie $2b$ compatible bcrypt. Tout est traite dans le navigateur, aucun mot de passe n'est envoye a un serveur.

Mot de passe / Texte

Facteur de cout (tours): 10 (1,024 iterations)

Plus eleve = plus securise mais plus lent. La valeur par defaut recommandee est 10.

Comment utiliser

Generez et verifiez des hachages de mots de passe au format bcrypt dans votre navigateur avec PBKDF2-SHA256.

1Type or paste the password or text you want to hash into the Password field.
2Choose a cost factor (4–14). Cost 10 is the recommended default for most applications.
3Click 'Generate Hash' and copy the resulting $2b$... hash to use in your project.
4To verify, switch to the Verify tab, enter the original password and the hash, then click Verify.

Fonctionnalités

PBKDF2-HMAC-SHA256 with bcrypt-compatible $2b$ output format
Configurable cost factor 4–14 with live iteration count display
One-click copy for generated hashes
Built-in verify tab — check any password against its hash instantly
100% browser-based — no passwords ever leave your device

Generateur de hachage Bcrypt

Comment utiliser

Fonctionnalités

Questions fréquentes

En savoir plus