Generate and verify bcrypt password hashes with an adjustable cost factor.
Generate bcrypt password hashes with an adjustable cost factor (4–15), or verify a password against an existing hash — all in your browser, so the password is never uploaded. Each hash includes a random salt. Powered by bcryptjs.
Upload your file using the tool above.
Adjust any settings to your preference.
Click the process button and wait for results.
Download your output using the download button.
Twelve is a reasonable default today. Each increment doubles the work, so 12 is roughly 16× slower than 8 — that slowness is the point, since it applies to an attacker’s billions of guesses too. Benchmark on your own hardware and pick the highest value that keeps login under about 250ms.
bcrypt generates a random salt per hash and stores it inside the output string. That is why two users with the same password get different hashes, and why precomputed rainbow tables are useless. Verification works because the salt is read back out of the stored hash before comparing.
No. This runs in your browser and nothing is transmitted, but hashing belongs in your server-side auth code where the plaintext never travels. Use this to understand the format, generate a test fixture, or verify a hash you already have — not as part of a real registration flow.
Yes, Bcrypt Generator is completely free. No signup, no account, and no watermark on outputs. A Pro tier is available for 100 AI ops/day and larger file sizes.
Bcrypt Generator runs entirely in your browser. Your file is never uploaded — it is read, processed and saved locally, so it never reaches our servers or anyone else's. You can disconnect from the internet after the page loads and it still works.
What is bcrypt? A password-hashing function designed to be deliberately slow, which makes brute-force and rainbow-table attacks impractical. Each hash includes a random salt, so the same password hashes differently every time.
Cost factor: The work factor (4–15) sets how slow hashing is — each step doubles the time. 10–12 is a common production choice; higher is safer but slower.
Verifying: You can’t “decrypt” a bcrypt hash — you verify by hashing the candidate password and comparing, which is exactly what Verify mode does.
Privacy: All hashing runs locally in your browser via bcryptjs. Passwords are never uploaded. For real user auth, always hash on the server too.