RandomKeygen

Free · Private · Client-side

Bcrypt Hash Generator

Generate real bcrypt password hashes with configurable cost factors. Hashing runs entirely in your browser — every hash embeds a fresh random salt, and you can verify passwords against the hash below.

Generated values never leave this device.

Processed locally — never transmitted

41015

2^10 = 1,024 iterations (~<100ms in-browser)

bcrypt with cost 10 ≈ 2^10 = 1,024 iterations — higher cost slows brute force. For reference, cost 12 ≈ 4,096 iterations, ~250ms per guess on a modern CPU.

Hashing runs in your browser

This tool computes real bcrypt hashes client-side with bcryptjs. Cost factors above 12 can take several seconds per hash in the browser — the page may feel unresponsive while hashing.

Cost Factor Recommendations

Development

  • 4-6 rounds: Fast for testing
  • 8 rounds: Good for development
  • Trade-off: Speed over security

Production

  • 10 rounds: Minimum recommended
  • 12 rounds: Good balance
  • 14-15 rounds: High security

Bcrypt security benefits

  • Adaptive cost: Can increase difficulty over time as hardware improves
  • Built-in salt: Each hash includes a unique salt to prevent rainbow table attacks
  • Time-tested: Industry standard for password hashing since 1999
  • Slow by design: Computationally expensive to discourage brute force attacks

Usage in Applications

Node.js (bcrypt library)

const bcrypt = require('bcrypt');
const saltRounds = 10;

// Hash password
const hash = await bcrypt.hash(plainTextPassword, saltRounds);

// Verify password
const match = await bcrypt.compare(plainTextPassword, hash);

Python (bcrypt library)

import bcrypt

# Hash password
hash = bcrypt.hashpw(password_bytes, bcrypt.gensalt(rounds=10))

# Verify password
match = bcrypt.checkpw(password_bytes, hash)

Generate Bcrypt in Terminal

Apache htpasswd utility

$htpasswd -bnBC 10 "" "password" | tr -d ':\n'

Python bcrypt

$python3 -c "import bcrypt; print(bcrypt.hashpw(b'password', bcrypt.gensalt(rounds=10)).decode())"

Node.js bcrypt

$node -e "console.log(require('bcrypt').hashSync('password', 10))"