BCrypt Hash Generator

Blowfish Adjustable Cost 192-bit
Anish Nath
Generate BCrypt Hash
Password
Cost Factor (2n iterations)
Cost 12 recommended for 2024. Higher = slower but more secure.
Verify Hash
BCrypt Hash Output

BCrypt hash will appear here

Enter a password to generate hash
BCrypt Hash Anatomy
$2a$10$N9qo8uLOickgx2ZMRZoMyejhYJH9cRpPsJvp2O5arBFpTIxRVyqk
$2a$ Algorithm version
10 Cost factor (210 rounds)
22 chars Base64 salt (128-bit)
31 chars Base64 hash (184-bit)
Related Password Hashing Tools
Scrypt

Memory-hard password hashing
Argon2

Modern password hashing winner
htpasswd

Apache/Nginx auth file generator
PBKDF2

Password-based key derivation

Support This Free Tool

Every coffee helps keep the servers running. Every book sale funds the next tool I'm dreaming up. You're not just supporting a site — you're helping me build what developers actually need.

500K+ users
200+ tools
100% private
☕ One-time support Buy me a coffee 📚 Learn & support 9-Book Bundle - $9 Stay updated Follow @anish2good
Privacy Guarantee: Private keys you enter or generate are never stored on our servers. All tools are served over HTTPS.
Understanding BCrypt
What is BCrypt?

BCrypt is a password hashing function designed by Niels Provos and David Mazières in 1999, based on the Blowfish cipher. It was first implemented in OpenBSD and is now widely used across platforms.

Key Features
  • Adaptive Cost: Adjustable work factor to increase computational time as hardware improves
  • Built-in Salt: 128-bit random salt stored within the hash itself
  • Fixed Output: Always produces 60-character string (192-bit hash)
  • Slow by Design: Intentionally CPU-intensive to resist brute-force attacks
  • GPU Resistant: Memory access patterns make GPU attacks less effective than SHA-based hashes
  • 72-byte Limit: Only first 72 bytes of password are used
Cost Factor Recommendations
Cost Iterations ~Time (2024 hardware) Use Case
10 1,024 ~100ms High-traffic APIs, mobile apps
12 4,096 ~300ms Recommended default
14 16,384 ~1s High-security applications
16 65,536 ~4s Extreme security (key derivation)
Version Prefixes
Prefix Description
$2$ Original specification (obsolete)
$2a$ Updated spec with UTF-8 support. Most common.
$2b$ OpenBSD fix for wraparound bug (2014)
$2y$ PHP-specific fix. Equivalent to $2b$ in practice.
Code Examples

Java (Spring Security)

BCryptPasswordEncoder encoder =
    new BCryptPasswordEncoder(12);
String hash = encoder.encode(password);
boolean match = encoder.matches(
    password, hash);

Python

import bcrypt
hash = bcrypt.hashpw(
    password.encode(),
    bcrypt.gensalt(rounds=12))
bcrypt.checkpw(password, hash)
Quick Access