How it works
The Bcrypt Tester hashes a password using the bcrypt algorithm and verifies whether a plaintext password matches an existing bcrypt hash — the two core operations used in password security for web applications.
Bcrypt is the gold standard for password storage. Unlike SHA-256 or MD5, bcrypt is specifically designed to be slow and computationally expensive, making brute-force attacks impractical. A cost factor (work factor) of 10–12 means hashing takes ~100–300ms on modern hardware — fast enough for user login, slow enough to make offline dictionary attacks extremely expensive.
How to use it — Hash mode: enter a plaintext password and choose a cost factor (10 is standard for most applications, 12 for sensitive use cases). Click Hash to get the bcrypt hash. The hash includes the salt (randomly generated per hash), the cost factor, and the hash value — all in one string.
How to use it — Verify mode: paste an existing bcrypt hash and enter the plaintext to test against it. The tool returns "Match" or "No match" by running bcrypt's comparison function locally.
Bcrypt hash anatomy: $2b$12$SomeRandomSaltHere.HashValueHere. The $2b$ prefix is the bcrypt version. $12$ is the cost factor. The next 22 characters are the salt. The remaining 31 characters are the hash. The salt is embedded — you never need to store it separately.
Warning: bcrypt with a cost factor above 14 may be slow in the browser (taking several seconds). Cost factors 10–12 are recommended for this tool.
Frequently Asked Questions
- Bcrypt is intentionally slow — the cost factor (work factor) controls how many iterations the hashing algorithm performs. At cost 10, hashing takes ~100ms. At cost 12, ~400ms. This slowness makes brute-force attacks expensive: an attacker who steals a bcrypt hash database needs hundreds of years to crack all passwords.
- Cost 10 is the standard recommendation for most web applications. Cost 12 is appropriate for high-security contexts. Choose the highest factor that keeps login time under 300ms on your server hardware. Re-evaluate as hardware improves — upgrading cost from 10 to 12 requires rehashing passwords at next login.
- Yes — bcrypt truncates inputs at 72 bytes. Passwords longer than 72 characters produce the same hash as the first 72 characters. For passwords longer than 72 characters, pre-hash with SHA-256 before bcrypt hashing. Most applications are not affected since few users have 72+ character passwords.
- Argon2 (specifically Argon2id) is the current recommendation from the OWASP Password Storage Cheat Sheet and won the 2015 Password Hashing Competition. It's memory-hard, making GPU attacks even less effective. Use Argon2id for new applications; bcrypt remains acceptable for existing systems.