Bcrypt Generator

The tool creates one-way password hashes with bcrypt. Bcrypt uses the Blowfish key schedule. Enter a password and choose a cost factor. A higher cost increases the work required for each guess and also increases the hashing time.

Bcrypt is a password-hashing function based on the Blowfish key schedule. Its configurable work factor increases the cost of testing each password candidate. It does not prevent guessing, and the appropriate cost depends on the deployment's latency, hardware, rate limiting, and password policy.

The architects of Bcrypt are Niels Provos and David Mazières. They designed bcrypt with an adjustable cost so applications could increase the work needed to test a password as hardware became faster. Their design is described in the Open BSD Bcrypt paper.

Bcrypt uses a modified Blowfish key setup with an adjustable cost factor. A higher cost makes each password check take more work. To verify a password, bcrypt uses the salt and cost stored in the hash, then compares the result. Choose a cost your login service can handle and review it as your hardware changes.

Bcrypt produces a one-way hash with no decryption key. Verification hashes a candidate password using the stored parameters and compares the result; an attacker can test candidates in the same way. If you need reversible encryption instead, use the Encrypt Tool. For a quick refresher, see Encryption vs Encoding vs Hashing.

Bcrypt is a password-hashing function with an adjustable cost factor. It remains useful when an application already stores bcrypt hashes or when Argon2id and scrypt are unavailable. For a new password-storage design, OWASP recommends Argon2id; use the Argon2id Hash Tool to compare the newer workflow.

Use the Verify Bcrypt Tool to compare plaintext with your bcrypt hash to see if they match.