Bcrypt Hash Generator
Generate a bcrypt password hash with a configurable cost factor, and optionally check it against an existing hash. Runs entirely in your browser — nothing is sent to a server.
Input
Each increment doubles the work factor. 10-12 is the common default; higher is slower but harder to brute-force.
Uses bcrypt's own comparison, so it works regardless of the compared hash's cost factor or salt.
Output
Only shown when a hash to compare is provided.
Guides
Bcrypt is the hashing algorithm most web frameworks reach for when storing passwords, because it's deliberately slow and its cost factor can be tuned upward as hardware gets faster. This tool computes a real bcrypt hash from any text, and can check a hash you already have against the same text.
Everything runs in your browser via bcryptjs — nothing you type here is sent anywhere.
How to use it
Paste the password or text you want to hash into the input box. Cost factor sets bcrypt's work factor: each step doubles the computation, so 12 takes roughly twice as long as 11. 10-12 is the common default for web apps today; go higher only if you've benchmarked your server can absorb the extra CPU time per login.
Every hash uses a fresh random salt — that's correct bcrypt practice, and it's why hashing the same text twice gives you two different-looking hashes. Both are equally valid; bcrypt's own comparison logic reads the salt back out of the hash itself, so you never need to track it separately.
To verify a hash instead of just generating one, paste it into the "Compare with existing hash" field alongside the plaintext. The tool reports Match or No match — this works even if the hash was created with a different cost factor than the slider is currently set to.
Why does hashing the same password give a different result each time?
Because a new random salt is generated per hash, which is what makes bcrypt resistant to rainbow-table attacks — two users with the password "password123" end up with completely different stored hashes. Use the compare field to check equality, never a direct string comparison of two hashes.
What cost factor should I actually use?
High enough that hashing takes a noticeable fraction of a second on your server, since that's what makes brute-forcing expensive too. 10 is bcrypt's traditional default; many current guides recommend 12. This tool caps out at 14, since it computes the hash synchronously in your browser and higher factors start to noticeably freeze the page — your backend, running compiled bcrypt rather than pure JavaScript, can typically go higher without the same cost.
Is this the same as the bcrypt my backend uses?
Yes — bcryptjs is a compatible, pure-JavaScript implementation of the same algorithm, and its output is a standard bcrypt hash ($2a$/$2b$ prefixed) that any bcrypt library in any language can verify, and vice versa.
Can I use this to hash something other than a password?
You can, but bcrypt is built for exactly this one job — slow, salted, one-way hashing of short secrets. For general-purpose hashing (checksums, file integrity, non-secret data), use the SHA or MD5 hash generator instead, which are fast rather than deliberately slow.
Use it from code
From 3 credits per callREST API
curl -X POST https://api.iotools.cloud/v1/tool/bcrypt-hash-generator \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"messageToHash": "correct horse battery staple",
"saltRounds": "10",
"expectedHash": ""
}'Swap in your own key from your account. The tool's fields are the body — no wrapper.
Ask an AI agent
Use the IOTools `bcrypt-hash-generator` tool (Bcrypt Hash Generator) on this input:
YOUR_INPUT_HEREPaste this at any agent connected to the IOTools MCP server, then add your input.