Bcrypt Generator & Verifier

What Is bcrypt?

Bcrypt is a password hashing function designed by Niels Provos and David Mazières in 1999. Unlike fast hash functions like MD5 or SHA-256, bcrypt is intentionally slow — making it computationally expensive to brute-force stored password hashes. It's the most widely deployed password hashing scheme in web applications today.

Understanding the Cost Factor

The cost (or work factor) is a logarithmic value that controls how many iterations of the key schedule are applied: 2^cost iterations. At cost 10, bcrypt runs 1,024 iterations; at cost 12, it runs 4,096 iterations.

• Cost 10 — Default. Takes ~100ms on modern hardware. Recommended for most web applications.
• Cost 12 — Slower (400ms). Good for sensitive applications where security is paramount.
• Cost 4 — Fastest (testing only). Do not use in production.

As hardware gets faster over time, you can increase the cost factor to maintain the same level of protection.

Reading a bcrypt Hash

A bcrypt hash looks like: $2b$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy

• $2b$ — bcrypt version identifier
• 10$ — cost factor
• Next 22 chars — the random salt
• Remaining 31 chars — the hash

bcrypt vs Other Password Hashing Schemes

For new systems, also consider Argon2 (winner of the 2015 Password Hashing Competition — better memory-hardness than bcrypt) or scrypt. However, bcrypt has decades of production use and broad support across every major language framework, making it a solid, proven choice.

Read our complete password security guide →