bcrypt Generator & Verifier
Generate bcrypt hashes with random salts, or verify an existing hash. Check the UTF-8 byte limit and choose an explicit cost.
Generate or verify one password
Generate returns a standard $2a$ bcrypt string, including the cost and salt. Verify reads its parameters from an existing $2a$, $2b$ or $2y$ string and returns a boolean. It does not return the password. A mismatch is a successful verification operation with matches=false.
The default cost is 12 and the default salt is 16 cryptographically random bytes. A custom salt must contain exactly 32 hexadecimal digits; reuse it only when reproducing a test vector or an existing system. Costs below 10 show a diagnostic.
The 72-byte boundary
The password is UTF-8 encoded, without trimming or normalization. This tool rejects input over 72 bytes instead of silently truncating it; a Chinese character commonly occupies three bytes. Empty passwords and embedded NUL bytes are supported. These cases use the compatible bcryptjs engine, avoiding the WASM wrapper’s empty-input restriction and NUL truncation.
This browser tool caps generation and verification costs at 16 and runs in a cancellable Worker with a 30-second deadline. These are browser resource limits, not limits of the bcrypt format. Benchmark your production authentication service separately.
Reference
Questions & answers
Can bcrypt decrypt a password?
No. It is a password hash. Verification recomputes the function using a candidate password and compares the result.
Why does a Chinese password reach the limit sooner?
The limit counts encoded bytes, not displayed characters. The tool checks the actual UTF-8 byte length.
Is my input uploaded?
No. Processing runs in your browser. Engines load from this site; the tool does not send input to a processing API or save it. Clear removes the visible input and result.