Bcrypt Generator

The Bcrypt Hash Generator creates one-way password hashes using bcrypt, which is based on the Blowfish key schedule. Enter your text and choose a salt cost. Higher cost values improve resistance to brute-force attacks but take longer to compute.

Bcrypt is a password-hashing function based on the Blowfish key schedule. Its configurable work factor increases the cost of testing each password candidate. It does not prevent guessing, and the appropriate cost depends on the deployment's latency, hardware, rate limiting, and password policy.

The architects of Bcrypt are Niels Provos and David Mazières. Their goal was to craft a password hashing technique that could keep pace with the rapid advancements in computer hardware. They analyzed the constraints of earlier password schemes, like crypt and MD5, and recognized the necessity for a more resilient method capable of standing up to future technological developments. You can delve into the details of Bcrypt's development in the Open BSD Bcrypt paper.

Bcrypt employs a modified version of the Blowfish keying algorithm, coupled with a variable cost factor. This cost factor dictates the number of iterations the key setup algorithm undergoes, impacting the computational effort needed to hash a password. Thus, as computational power amplifies, the cost factor can be tweaked to ensure consistent security levels. When a user inputs a password, Bcrypt hashes it, compares the hash with the stored hash, and if they coincide, the password is authenticated.

Bcrypt produces a one-way hash with no decryption key. Verification hashes a candidate password using the stored parameters and compares the result; an attacker can test candidates in the same way. If you need reversible encryption instead, use the Encrypt Tool. For a quick refresher, see Encryption vs Encoding vs Hashing.

Bcrypt is a password-hashing function with an adjustable cost factor. It remains useful when an application already stores bcrypt hashes or when Argon2id and scrypt are unavailable. For a new password-storage design, OWASP recommends Argon2id; use the Argon2id Hash Tool to compare the newer workflow.

Use the Verify Bcrypt Tool to compare plaintext with your bcrypt hash to see if they match.