Create bcrypt password hashes and check a password against an existing hash.
A bcrypt hash is 60 characters, for example $2b$10$ followed by 53 more. The $2b$ part is the version, 10 is the cost, the next 22 characters are a random salt and the last 31 are the hash itself. Because the salt is random and stored inside the hash, the same password gives a different hash every time, and any of them will verify correctly.
The cost sets how much work each hash takes. Every step up doubles the time: 10 is quick, 12 is a popular choice for servers, and this tool stops at 15 because higher costs can take minutes in a browser. Pick the highest cost your server can handle during login without feeling slow.
Bcrypt only reads the first 72 bytes of a password; the tool warns you if your text is longer. The hash is made in your browser with bcryptjs, which produces standard hashes that PHP's password_verify, Node's bcrypt, Python's bcrypt and Spring Security all accept.
Each hash gets a new random salt. That's intended: it stops attackers from using precomputed tables.
They are versions of the same algorithm that differ in an old edge-case fix. Most libraries accept all three, and the checker here does too.
Start at 10 to 12 and measure on your server. Aim for around a quarter of a second per hash.
No. Hashing and checking run in your browser.
OneClickly is a set of 119 free tools for PDFs, images, text, everyday math and code. They run in your browser, so the files and text you work with stay on your device.