How to make and check a bcrypt hash
- Type the password into Password or text and set the Cost factor; 10 to 12 suits most websites.
- Press Generate hash (or Enter) and copy the hash. The breakdown shows its version, cost, salt and hash parts.
- To test a hash, type a password and paste the hash under Check a password against a hash, then press Check.
What bcrypt is for
bcrypt is a password hashing function from 1999, built to be slow on purpose. A website stores the bcrypt hash instead of the password; at login it hashes what you typed with the salt from the stored hash and compares. If the database leaks, every guess an attacker makes costs the same work, so trying billions of common passwords becomes expensive, unlike fast hashes such as MD5 or SHA-256.
Reading a bcrypt hash
A hash like $2b$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy has four parts: $2b$ is the version, 10 is the cost, the next 22 characters are the salt and the last 31 are the hash itself, both in bcrypt’s own Base64 alphabet. Newer designs often use Argon2 or scrypt, which also make attacks with graphics cards costly, but bcrypt remains widely supported and a sound choice.