🧂Bcrypt Hash

How to hash a password with bcrypt

1. Type the password and choose a cost factor — 10 is a sensible default, 12 is what many frameworks use today.
2. Press Generate hash. The $2a$10$… string contains the algorithm, the cost, a random 16-byte salt and the hash itself, so it is the only thing you need to store.
3. To test a login, paste the stored hash and a candidate password into Verify a password.

FAQ

Why is every hash of the same password different?

Bcrypt generates a new random salt each time, so two users with the same password get different hashes and a stolen database cannot be attacked with a precomputed rainbow table. Verification still works because the salt is stored inside the hash.

Which cost factor should I use?

Pick the highest cost your server can afford at peak login traffic — around 250 ms per hash is a common target, which is cost 11–13 on modern hardware. The timing shown here is measured in your browser and is usually slower than a server.

Bcrypt, Argon2 or PBKDF2?

Argon2id is the strongest modern choice because it also costs the attacker memory. Bcrypt is battle-tested and available everywhere. PBKDF2 is the weakest of the three against GPUs but is built into every platform, including the browser you are using right now.