🔐 BCrypt Hash Generator & Verifier
Client-side BCrypt password hash toolkit with three tabs: Generate (cost 4-15, $2a/$2b/$2y version selector, 3 output formats), Verify (auto-parses cost/version with OWASP guidance), and Inspect (dissect any bcrypt hash into prefix/cost/salt/hash). Real-time 72-byte truncation warning, progress bar, cancel button, and mobile-friendly chip controls.
0 / 72 bytes
OWASP 2026 recommends cost ≥ 12
💡 Why does OWASP 2026 recommend Argon2id first?
OWASP Password Storage Cheat Sheet 2026 recommended order:
- Argon2id — First choice. Memory-hard, resistant to GPU / ASIC attacks
- bcrypt — Mature ecosystem, legacy compatibility. cost ≥ 12
- PBKDF2 — FIPS compliance scenarios
- scrypt — Acceptable alternative
Real-world bcrypt pitfall: silent 72-byte truncation (UTF-8 Chinese hits the limit at just 24 characters). Real auth bypass incidents at FreshRSS, Mealie, and others. Prefer Argon2id for greenfield systems.
Free online BCrypt password hash generator and verifier with three modes: Generate (enter password + cost factor 4-15 + $2a/$2b/$2y version selector → bcrypt hash output as raw / user:hash / JSON format), Verify (enter password and hash for automatic match check with parsed cost and version plus OWASP 2026 guidance), and Inspect (paste any bcrypt hash string for four-segment color-coded breakdown of prefix/cost/salt/hash). Key features: browser-side computation powered by the mature bcryptjs 3.x library with lazy loading. Your password, salt, and hash are not uploaded by the tool and are not persisted to localStorage. Built-in real-time 72-byte counter (UTF-8 Chinese hits the limit at just 24 characters, preventing FreshRSS-style authentication bypass pitfalls), mobile-optimized cost chip controls, progress bar with cancel button (bcryptjs cooperatively yields every 100ms keeping UI responsive), automatic version prefix rewriting with honest algorithm-equivalence disclosure (all three prefixes produce identical algorithm output and only differ by consumer compatibility), and OWASP 2026 Argon2id upgrade guidance. Ideal for seeding test accounts, debugging login issues, validating legacy hash formats during system migrations, and studying bcrypt cryptography. Optimized for both desktop and mobile with 44px touch targets, dark mode support, and prefers-reduced-motion respected.