Last updated October 13, 2026 · Report an error
Bcrypt is a widely-used, purpose-built algorithm for hashing passwords — unlike general hash functions (MD5, SHA-256), it's deliberately slow and includes a built-in random salt, making it resistant to brute-force and rainbow-table attacks.
This tool generates a Bcrypt hash for a password, with a configurable cost factor controlling how slow (and secure) the hash is.
How it works
Enter a password and, optionally, a cost factor (4-14, default 10). The tool generates a random salt automatically and applies the Bcrypt algorithm 2^cost times, then encodes the algorithm version, cost, salt, and resulting hash together into one string.
- Enter password.
- Enter cost factor (4-14, default 10).
- Click Calculate to see your results.
Examples
Default cost factor
Hashing "correct horse battery staple" at the default cost of 10 produces a hash starting with $2y$10$, followed by the embedded salt and hash.
Who should use it
- Understanding how Bcrypt password hashing works.
- Generating a test hash for development or documentation purposes.
Industry applications
- Web application security
- Software development and authentication systems
Advantages
- Includes a random salt automatically — no separate salt storage needed.
- Configurable cost factor lets you balance security and performance.
Limitations
- Higher cost factors intentionally take longer to compute, which can add latency to login flows if set too high.
Common mistakes to avoid
- Expecting the same password to always produce the same hash — Bcrypt's random salt makes every hash unique, even for identical passwords.
- Setting the cost factor too low for a production system, making brute-force attacks more feasible.
Best practices
- Use a cost factor high enough that hashing takes a noticeable fraction of a second on your server — this keeps login fast for real users while remaining slow for attackers guessing many passwords.
Tips
- In real applications, always use your programming language's built-in password-hashing function (like PHP's password_hash) rather than hand-rolling parts of the process — it correctly handles salt generation and encoding for you.