Bcrypt Hash Generator

Generates and verifies bcrypt password hashes right in the browser, using bcrypt.js — nothing you type here goes anywhere else. Useful for testing a hashing implementation, sanity-checking what a given cost factor actually produces, or verifying a hash already sitting in a database.

Why bcrypt specifically, and not just any hash

Bcrypt was built for one job — hashing passwords — and it's deliberately slow, which is the opposite of what you'd normally want from a hash function and exactly what you want here. It bakes in a random salt automatically, so identical passwords never produce identical hashes, which kills rainbow table attacks outright. And the cost factor is adjustable, meaning you can dial up the work factor as hardware gets faster instead of being stuck with whatever was reasonable a decade ago. OWASP's baseline recommendation is cost factor 10 as a floor for new applications, not a ceiling.

Picking a cost factor

• 4–6 — fine for local testing, far too fast to be acceptable anywhere near production
• 10–12 — the OWASP-recommended range for most real applications
• 13–14 — meaningfully more secure, at the cost of a noticeable 1–2 second delay on login — a legitimate tradeoff for high-value accounts, less so for a consumer app where every extra second of login friction has a measurable cost

The mistake that still happens more than it should

MD5, SHA-1, even plain SHA-256 are general-purpose hash functions, and general-purpose means fast — which is exactly the wrong property for password storage. A modern GPU can run through billions of SHA-256 hashes a second, which makes brute-forcing a leaked hash database trivial if that's what protected it. Bcrypt, Argon2 and scrypt are deliberately slow and memory-hungry, which is precisely what makes GPU-based cracking impractical at scale. If a system you're reviewing is still using raw SHA-256 for password storage, that's a finding worth raising, not a minor style preference.