Developer Tools
BCrypt Generator
Turn any password into a bcrypt hash with the $2b$ prefix, a random salt, and the cost factor you choose — then verify any hash against a password. Matches Laravel, WordPress, Node, and htpasswd output. All in your browser.
Algorithm
$2a$
Verify a hash
What makes this tool different
Framework-compatible
Output works with Laravel, WordPress, Node.js, PHP, and htpasswd without conversion.
Configurable cost factor
Adjust the work factor from 4 to 12 to balance security and performance.
Automatic salt
Each hash embeds a fresh random salt — no need to generate or store one separately.
Verify mode
Paste a hash and a password to check if they match, exactly like your backend does.
About this tool
BCrypt Generator: everything you need to know
Storing passwords correctly is one of the most important security decisions a developer makes. Plain hashes like SHA-256 are far too fast to resist modern GPU brute-force, and unsalted hashes let identical passwords be recognized instantly. Bcrypt solves both problems: a deliberately slow, salted, adaptive hash that has been the default in PHP, Node, and major frameworks for over a decade.
This bcrypt generator produces the exact $2b$ format these frameworks expect. Enter a password, pick a cost factor from 4 to 12, and get a hash with a fresh embedded salt. Paste it straight into a Laravel seeder, a WordPress database, a Node auth module, or an htpasswd file.
The verify mode mirrors what your login code does: given a stored hash and a submitted password, it recomputes the hash with the salt and cost embedded in the stored string and reports whether they match. That is the same operation password_verify() or bcrypt.compare() performs server-side.
The cost factor is your security dial. Higher values make each guess exponentially slower, which is exactly what you want against attackers — but they also slow down your own login flow. A common starting point is 10, with 12 or more recommended as hardware improves.
Because hashing happens in your browser via the bundled bcrypt implementation, the password never leaves your device. There is no server call, no logging, and no storage of anything you type. Open the DevTools Network tab and you will see zero requests.
Remember that bcrypt protects passwords at rest, not in transit. Always serve your site over HTTPS, and pair strong hashing with the other essentials — rate limiting, account lockout, and never logging passwords. Generate and verify hashes here, then enforce those practices in your backend.
FAQ
BCrypt Generator — frequently asked questions
What is bcrypt and why is it used for passwords?
Bcrypt is a password-hashing function designed to be slow and salted. It uses a Blowfish-based key schedule with a configurable cost factor, making brute-force attacks expensive. That is why frameworks like Laravel, WordPress, and Node's bcrypt package store passwords as $2b$ hashes.
What does the $2b$ prefix / full bcrypt string mean?
A bcrypt hash looks like $2b$10$R...$... — $2b$ is the algorithm version, 10 is the cost factor (2^10 rounds), then comes a 22-character salt and a 31-character hash, both Base64-encoded. The whole string is self-contained: the algorithm, cost, salt, and hash are all in one value.
What is the bcrypt cost factor / work factor?
It is the exponent of 2 for how many rounds bcrypt runs — cost 10 means 2^10 rounds, cost 12 means 2^12. Higher costs are stronger but slower. The default is 10; you can raise it as hardware improves.
How do I generate a bcrypt hash in Laravel / WordPress / PHP / Node?
In Laravel use Hash::make($password); in WordPress use wp_hash_password(); in PHP use password_hash($pw, PASSWORD_BCRYPT); in Node use bcrypt.hashSync(pw, 10). All produce the same $2b$ format this tool generates — you can verify cross-framework consistency here.
Bcrypt vs SHA256 — why not just hash with SHA?
SHA-256 is fast, which is exactly the problem: attackers can try billions of guesses per second. Bcrypt's cost factor intentionally slows hashing, and it salts each hash automatically, so identical passwords produce different hashes and brute-force is far more expensive.
How do I verify a bcrypt password hash?
Use bcrypt.compare(password, hash) (Node), password_verify($pw, $hash) (PHP), or Hash::check() (Laravel). The comparison recomputes the hash with the embedded salt and cost, then checks equality. This tool's verify mode does the same thing in your browser.
What is a bcrypt htpasswd entry?
An htpasswd file can store Apache credentials with bcrypt. Each line is username:$2b$10$...$.... Generate the hash here, paste it into the htpasswd file, and Apache will validate logins against it.
Is bcrypt with salt automatic?
Yes. Every bcrypt hash embeds its own random salt generated at hashing time, so you never store or manage salts separately. This tool generates a fresh salt for every hash by default.
Is the bcrypt generator free and private?
Yes. OpenToolLab's bcrypt generator is completely free, requires no signup, and computes hashes in your browser — your password never leaves your device.
Keep exploring