Why is the same password different every time?

Bcrypt includes a random 16-byte salt, embedded in the hash itself (characters 8–29), so identical passwords produce different hashes. Verification reads the salt back out of the hash.

What is the 72-byte limit?

bcrypt only processes the first 72 bytes of the password; anything longer is silently ignored. Multi-byte characters count as 2–4 bytes each, so the tool shows a byte counter. If you must accept longer input, pre-hash it (e.g. SHA-256 then base64) before bcrypt.

What is the difference between $2a$, $2b$ and $2y$?

Nothing in the output bytes — all three use the same algorithm. They record which implementation minted the hash (original OpenBSD, the 2014 wraparound fix, or PHP crypt). Pick the prefix your verifier expects; most libraries accept all three.

Is bcrypt still secure?

For most applications, yes. Argon2id is modern and slightly preferred for new systems, but bcrypt with cost 12+ remains a safe, well-audited choice.

Bcrypt Generator / Checker

Generate bcrypt hashes with a configurable cost factor and $2a$/$2b$/$2y$ prefix, verify a password against an existing hash, hash a whole list at once, or produce a salt and hash with it for reproducible tests. Pasted hashes are validated with clear messages and their cost is detected with an estimated verification time. A benchmark table times cost 4–14 on your device so you can pick a work factor. Hashing runs in the browser with bcryptjs, yielding between rounds so the page stays responsive.

Runs locally in your browser

Password

0 / 72 bytes

Cost factor (rounds)12

2^12 = 4,096 iterations

Prefix

Use a specific salt (optional)

Hash

Press Generate hash (⌘/Ctrl+Enter) to hash the password.

Cost

12 (2^12)

Estimated

…

Last run

—

Prefix

$2b$

Hash Generator

MD5, SHA-1, SHA-256/384/512, SHA-3, CRC32 and xxHash32 for text, lines and files — with verify and checksum export.

HMAC Generator & Verifier

Sign and verify HMAC-SHA256/SHA1/SHA512/MD5/SHA-3 signatures with Stripe, GitHub, Shopify, Slack and Twilio presets.

Password Generator

Strong random passwords, diceware passphrases, PINs and pronounceable codes with crack-time estimates.

JWT Decoder

Decode, verify (HS/RS/ES/PS, JWKS) and sign JWTs

How to use Bcrypt Generator / Checker

1Enter a password (or one per line in Bulk), choose the cost factor and prefix, then click Generate.
2To check a hash, switch to Verify, paste the hash and password, and press ⌘/Ctrl+Enter.
3Use Salt to generate a salt and hash deterministically with it for tests.
4Run Benchmark to see how long each cost factor takes on this device.

About Bcrypt Generator / Checker

Bcrypt Generator / Checker is part of FizzKit — a collection of focused developer and ad-tech tools. Because everything runs locally, it works offline once loaded and never exposes your data to a remote server.

Frequently asked questions

12 is a sensible default in 2026 (about 250 ms per hash on a server core). Higher values increase security but also login time — the work doubles per level. Run the benchmark and pick the highest cost that keeps logins under ~300–500 ms on your real hardware, remembering that native bcrypt is 2–4× faster than this browser implementation.

Related tools