Hash passwords with bcrypt and verify them against existing hashes. Tune the cost factor to match your hardware; verification mode checks a password against a hash.
Hash a password
bcrypt with a tunable cost factor. A fresh random salt is generated for every hash.
Higher cost means slower hashing and stronger protection. Cost 12 takes about a second here.
The crypto library loads from a CDN on first use, then everything runs locally. Nothing you type is uploaded.
Verify a password
Check a candidate password against an existing bcrypt hash.
Verification re-derives the hash with the stored salt and compares.
Bcrypt
The hash or the verification result appears below.
-
Advertisement
Adaptive password hashing
bcrypt, designed by Provos and Mazieres in 1999, is built on the Blowfish cipher's expensive key schedule (EksBlowfish). Its cost factor makes hashing deliberately slow, doubling the work with each increment, so hashes stay resistant as hardware improves. The output string embeds the algorithm version, cost and salt, for example $2a$10$....
Cost factor guidance
Cost 10 (1024 iterations) was the old default; modern guidance suggests 12 or higher, targeting roughly 250-500ms per hash on your server. Higher cost means better protection but slower logins, so benchmark on your own hardware. Always use a unique random salt per password, which bcrypt generates automatically.
Aim for about 0.25 to 0.5 seconds per hash on your production hardware; that is cost 12 on most current servers. This page caps cost at 12 to keep your browser responsive.
Why does the same password give different hashes?
bcrypt generates a fresh 128-bit random salt for every hash, so identical passwords produce different outputs. Verification re-derives with the stored salt.
How do I verify a password?
Paste the stored hash and the candidate password into verify mode. bcrypt extracts the salt and cost from the hash string and compares; it returns match or no match.
bcrypt vs Argon2?
Argon2id is the modern OWASP-recommended winner and resists GPU cracking better through memory hardness. bcrypt remains a solid, battle-tested choice with wider library support.
Is hashing done locally?
Yes. The bcryptjs library runs entirely in your browser; passwords are never uploaded. Still, prefer hashing server-side in real applications.