Bcrypt

About Bcrypt

Hash a string with bcrypt at a chosen cost (salt rounds), or check whether a string matches an existing bcrypt hash. Each hash uses a fresh random salt, and the result is broken down into algorithm version, cost, salt and hash, with the time it took. It runs bcryptjs in your browser, so the passwords you test are not sent anywhere.

Common uses

• Generate a bcrypt hash to seed a test user or an admin account in a database.
• Verify that a password matches a hash stored by your application.
• Measure how long different cost factors take before choosing one.
• Inspect the version, cost and salt embedded in an existing hash.

FAQ

Why does the same password give a different bcrypt hash each time?

bcrypt generates a random 16-byte salt for every hash and stores it inside the hash string. Verification reads the salt back from the stored hash, so different hashes of the same password all verify correctly.

What cost factor should I use?

The cost is a power of two: each increment doubles the work. 10 to 12 is a common range; pick the highest value that keeps login time acceptable on your servers.

Can a bcrypt hash be decrypted?

No. bcrypt is a one-way password hashing function. You can only check a guess by hashing it with the same salt and cost and comparing.

Is there a length limit on bcrypt input?

Yes. bcrypt only uses the first 72 bytes of the input, so longer passwords are effectively truncated.