- 1Choose file
- 2Adjust
- 3Download
Bcrypt Generator & Verifier online, free
Generate cryptographically secure salted Bcrypt password hashes and verify plaintext passwords against existing hashes.
- Runs in your browser — no upload
- Free, no sign-up, no watermark
- TXT
How to use Bcrypt Generator & Verifier · Bcrypt Generator & Verifier — frequently asked questions
How to use Bcrypt Generator & Verifier
- 1
Add your TXT file
Drop a file on the page, paste it, or click Select Files. Nothing is uploaded — it opens straight in your browser.
- 2
Fine-tune the settings
Set action in the Fine-tune panel, or keep the defaults — they suit most files.
- 3
Run Bcrypt Generator & Verifier
Press the start button. Processing happens on your device, usually in seconds.
- 4
Download the result
Save the finished file, or continue with another tool without downloading in between.
What Bcrypt Generator & Verifier can do
- Action: hash and verify
- Private by design — files are processed in your browser and never uploaded
- Free with no sign-up, no watermark and no daily limit
Bcrypt Generator & Verifier — frequently asked questions
What is Bcrypt and why is it used for passwords?
Bcrypt is an adaptive password hashing function based on the Blowfish cipher. It incorporates a random salt to protect against rainbow table attacks and includes a configurable work factor (cost parameter) that slows down attackers attempting brute-force attacks.
What do the cost factor rounds mean?
The cost factor (e.g. 10 or 12) determines the number of hashing iterations, calculated as $2^{\text{cost}}$. Cost 10 performs 1,024 iterations, while cost 12 performs 4,096 iterations. Increasing the cost makes the hash harder to crack with specialized hardware.
How do I verify a plaintext password against a Bcrypt hash?
Select the "Verify" option, enter your plaintext password in the password field, and paste the existing `$2a$...` or `$2b$...` hash. The tool computes the hash using the salt embedded in the string and confirms whether they match.
Are my passwords sent to any server?
No. Bcrypt calculation and verification run locally in your browser. Plaintext passwords never leave your computer or mobile device.
What does the `$2a$10$...` format represent?
The `$2a$` or `$2b$` indicates the Bcrypt specification version. The next two digits (`10`) represent the logarithmic cost factor. The remaining characters contain the 22-character Base64-encoded salt and the 31-character checksum.
Related tools
- Text to MD5 Hash GeneratorCalculate 128-bit MD5 hashes of text strings, passwords, and tokens instantly in your browser.
- Text to SHA-256 Hash GeneratorGenerate 256-bit cryptographic SHA-256 hashes of text, passwords, and tokens with uppercase/lowercase options.
- File Checksum (MD5 / SHA)MD5, SHA-1, SHA-256 and SHA-512 computed on your device; paste a hash to verify.
- Compare Two FilesByte-wise comparison with the first differing offset.
- CRC32 Checksum CalculatorCalculate standard 8-character IEEE 802.3 CRC32 checksums from text strings or binary files.
- CSR Generator & DecoderGenerate Certificate Signing Requests locally or decode existing PEM CSRs.
- HMAC Generator & CalculatorCompute Keyed-Hash Message Authentication Codes (HMAC) using secret keys across SHA-256, SHA-512, and SHA-1.
- Keccak-256 Hash GeneratorCompute Web3 and Ethereum-compatible Keccak-256 cryptographic hashes from text strings or hexadecimal byte arrays.