Bcrypt is a password hashing function based on the Blowfish cipher, specifically designed for password storage. It has a built-in salt mechanism that effectively prevents rainbow table attacks. Bcrypt automatically handles salt generation and storage — the output hash already contains salt information.

What is Cost Factor and what value should I use?

The Cost Factor determines the number of iterations for hash computation, using the formula 2^cost iterations. Each increment of 1 doubles the computation time. The recommended value is 10-12 for a balance between security and performance. For modern web apps, Cost Factor 10 is common, taking about 100ms to complete.

What is the format of a Bcrypt hash?

Bcrypt hash format: $2a$[cost]$[22-char salt][31-char hash]. Example: $2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy. Where 2a is the version, 10 is the Cost Factor, followed by the salt and hash portions respectively.

Why is Bcrypt better than MD5/SHA256 for storing passwords?

MD5 and SHA256 are general-purpose hash functions that are extremely fast (billions per second), making them vulnerable to brute-force attacks. Bcrypt is designed for passwords: 1) Built-in salt prevents rainbow table attacks; 2) Adjustable computational cost prevents brute-forcing; 3) Slowness is a feature — minimal impact on normal logins but greatly increases attack cost.

Bcrypt Hash Generator

Generate and verify Bcrypt password hashes securely

Cost Factor (10): Slow, very good security (recommended)

Estimated Time:~ 100ms

Enter Password

Verify Password

Enter a password and an existing Bcrypt hash to verify if they match

Password to Verify

Bcrypt Hash

Cost Factor Explanation

16 iterations

~1ms

Testing only

64 iterations

~5ms

Development

256 iterations

~20ms

General use

1024 iterations

~100ms

Recommended

4096 iterations

~400ms

High security

Bcrypt Hash Tool Guide

Key Features

Password Hashing - Generate secure Bcrypt hashes
Password Verification - Verify a password against an existing hash
Adjustable Security - Cost Factor adjustable from 4-12
Real-time Generation - Enter password to generate hash instantly

Use Cases

User password storage (recommended Cost Factor 10-12)
Password strength testing and verification
Developer debugging of password hashing
Security audit and password policy evaluation