Bcrypt Hash Generator

Bcrypt is a password hashing algorithm designed specifically to be slow — and that slowness is its greatest security feature. Unlike fast hashing algorithms like MD5 (which can compute 10 billion hashes per second on modern GPUs) or SHA-256 (5 billion per second), bcrypt at cost factor 12 produces only about 3-5 hashes per second on the same hardware. This makes brute-force attacks computationally impractical. A password hashed with MD5 can be cracked from a dictionary of 10 million common passwords in about 1 millisecond. The same dictionary against bcrypt at cost factor 12 would take roughly 23 days. Bcrypt also automatically handles salting — it generates a random 128-bit salt and embeds it in the output hash, so identical passwords produce different hashes. The output format is $2b$12$SALT22CHARS...HASH31CHARS... where $2b$ is the algorithm version, $12$ is the cost factor, followed by the salt and hash. This tool generates bcrypt hashes in your browser using a JavaScript implementation — your passwords are never transmitted to any server, which is exactly how security tools should work.

The cost factor (also called work factor or rounds) determines how many iterations bcrypt performs: the computation doubles with each increment. Cost factor 10 takes about 100ms, factor 12 about 400ms, and factor 14 about 1.6 seconds per hash. The recommended minimum for production systems in 2024 is cost factor 12, with factor 13-14 for high-security applications. The goal is to make each hash take 250ms-1 second on your server hardware — slow enough to deter attackers but fast enough that users do not notice during login. As hardware improves, you should increase the cost factor. When upgrading an existing system (say from cost 10 to 12), you can rehash passwords transparently at next login: verify the old hash, then compute and store a new hash with the higher cost factor. Bcrypt has a maximum input length of 72 bytes — passwords longer than this are silently truncated. For very long passphrases, pre-hashing with SHA-256 before bcrypt is a common workaround. Libraries exist in every major language: bcryptjs for Node.js, password_hash() in PHP, bcrypt gem in Ruby, and passlib in Python.