Generate bcrypt password hashes with configurable cost factor and verify passwords against existing hashes.
Type a password and a cost factor and this tool produces a bcrypt hash in the standard $2a$/$2b$ format, computing it locally with a freshly generated random salt each run. Paste an existing hash alongside a candidate password into the verify panel and it recomputes the hash using the salt embedded in that string to check for a match. The detail people miss most: bcrypt only reads the first 72 bytes of a password, so anything past that point is ignored, and because the salt is regenerated every run, hashing the same password twice on purpose never produces two identical strings - that is expected, not a bug.
The output is a 60-character string: a version tag ($2a$, $2b$, or $2y$), a two-digit cost between 4 and 31, then a 22-character salt and a 31-character hash, both encoded in bcrypt's own base64-like alphabet. Cost sets the number of key-setup rounds to 2^cost, so raising it by one roughly doubles the time needed to generate or verify a hash.
Verify mode never needs the original password saved anywhere: it parses the version, cost, and salt out of the pasted hash, reruns the same Blowfish-based key setup on the candidate password using that salt, and compares the result to the hash portion of the string. A match confirms the password produces that exact hash under those parameters.
Because bcrypt embeds a new random salt in every hash it produces, by design - that's what makes precomputed rainbow-table attacks impractical. Both hashes are equally valid for that password. To check whether a password matches a hash, use the verify function rather than comparing hash strings directly.
There is no single correct number - it depends on your server's hardware and how much login latency you can accept. OWASP's Password Storage Cheat Sheet suggests a bcrypt work factor of at least 10 as a floor, tuned upward as far as your hardware and response-time budget allow, so treat any figure as a starting point to benchmark.
The behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.