What cost factor (rounds) should I use?

For production passwords, use a cost factor of 10–12. Higher values are more secure but take longer to compute. The standard recommendation is 10 for most web applications.

Why does bcrypt take longer than MD5 or SHA?

Bcrypt is intentionally slow due to its key stretching algorithm. This makes brute-force attacks computationally expensive, which is exactly what you want for password hashing.

Why does the same password produce different hashes each time?

Bcrypt automatically generates a random salt for each hash, which is embedded in the output. This is by design and prevents rainbow table attacks.

Can I use bcrypt hashes directly in my database?

Yes. The full bcrypt output string contains the algorithm version, cost factor, salt, and hash — everything needed for future password verification.

Outils de Développement

Hasher les mots de passe avec bcrypt avec un facteur de coût configurable

Générateur de Hash Bcrypt

Hasher les mots de passe avec bcrypt avec un facteur de coût configurable

100% Hors ligneConfidentialitéSécurisé

Hachage de Mot de Passe

Mot de Passe à Hasher

Rondes de Sel: 10

Des valeurs plus élevées sont plus sécurisées mais prennent plus de temps à calculer

4 (Rapide)15 (Lent)

410 (Défaut) (10)15

Hash Bcrypt Généré

Learn more about Bcrypt Hash Generator

About Bcrypt Hash Generator

Generate bcrypt hashes from plaintext passwords for testing your authentication system. Set the cost factor (rounds), hash a password, and verify that a plaintext password matches an existing hash — all within your browser.

Key features

Generates bcrypt hash from any plaintext input
Adjustable cost factor (rounds) from 4 to 14
Verify mode: check if a password matches a hash
Displays the salt and hash components separately
All processing client-side — passwords never transmitted

How to use Bcrypt Hash Generator

1Enter the plaintext password you want to hash
2Set the cost factor (10–12 is typical for production use)
3Click "Generate Hash" to create the bcrypt hash
4Use the Verify tab to test if a password matches a hash

Frequently asked questions

What cost factor (rounds) should I use?: For production passwords, use a cost factor of 10–12. Higher values are more secure but take longer to compute. The standard recommendation is 10 for most web applications.
Why does bcrypt take longer than MD5 or SHA?: Bcrypt is intentionally slow due to its key stretching algorithm. This makes brute-force attacks computationally expensive, which is exactly what you want for password hashing.
Why does the same password produce different hashes each time?: Bcrypt automatically generates a random salt for each hash, which is embedded in the output. This is by design and prevents rainbow table attacks.
Can I use bcrypt hashes directly in my database?: Yes. The full bcrypt output string contains the algorithm version, cost factor, salt, and hash — everything needed for future password verification.