Bcrypt & Argon2 Password Hash Generator & Verifier
Generate cryptographically secure Bcrypt password hashes ($2b$) with custom cost rounds, or test password verification.
How do I use Bcrypt & Argon2 Password Hash Generator & Verifier?
Enter a plaintext password, adjust the Salt Rounds cost factor (4–12), or click 'Load Sample Data'.
Click 'Generate Bcrypt Hash' to compute a salted `$2a$` / `$2b$` modular crypt hash in your browser.
Use the 'Password & Hash Match Verifier' card below to test whether a plaintext password matches an existing Bcrypt hash.
What features does Bcrypt & Argon2 Password Hash Generator & Verifier offer?
100% client-side Bcrypt password hash generation ($2b$)
Adjustable salt rounds cost factor (4 to 12)
Hash vs Password verification tester
Zero server requests or password transmission — 100% local privacy
Bcrypt Eksblowfish Key Setup & Modular Crypt Format (`$2b$Cost$SaltHash`)
Designed by Niels Provos and David Mazières, Bcrypt embeds the algorithm version, exponential cost factor ($2^{\text{rounds}}$ iterations), 128-bit random salt, and 184-bit ciphertext inside a single 60-character ASCII string.
| Hash Segment / Cost | Format / Iterations | Char Length | Security & Latency Profile |
|---|---|---|---|
| Version Prefix | $2a$, $2b$, or $2y$ | 4 chars | $2b$ fixes 8-bit UTF-8 sign-extension bug |
| Cost Factor (Rounds) | 10 ($2^{10} = 1,024$), 12 ($2^{12} = 4,096$) | 3 chars (10$) | Each +1 round doubles CPU hashing time |
| Encoded 128-bit Salt | Radix-64 custom alphabet | 22 chars | Prevents precomputed rainbow-table lookups |
| Encoded 184-bit Digest | Eksblowfish cipher output | 31 chars | Total output string is always 60 ASCII chars |
Frequently Asked Questions about Bcrypt & Argon2 Password Hash Generator & Verifier
What is Bcrypt's 72-byte password truncation limit?
The underlying Eksblowfish cipher key schedule accepts a maximum of 72 bytes (which equals 72 ASCII characters, or as few as 18 four-byte UTF-8 emojis). Any characters beyond byte 72 are silently ignored—if you allow very long passphrases, pre-hash with `HMAC-SHA256` before passing to Bcrypt.
Why does hashing the exact same password twice produce two completely different Bcrypt strings?
Every time you click 'Generate Bcrypt Hash', the engine generates a fresh cryptographically random 16-byte (128-bit) salt. During verification, `verifyBcryptHash` extracts the embedded 22-character salt from the stored hash to reproduce the exact same output.
What is the difference between `$2a$`, `$2b$`, and `$2y$` Bcrypt prefixes?
All three run the identical Eksblowfish algorithm: `$2a$` was the original specification, `$2y$` was introduced by PHP to indicate correct unsigned 8-bit UTF-8 handling, and `$2b$` is the modern OpenBSD standard supported across Node.js, Python, Go, and Spring Security.
Why does increasing Salt Rounds from 10 to 12 make the browser pause for ~300ms?
Bcrypt is intentionally CPU-expensive: cost 12 performs $2^{12} = 4,096$ rounds of Eksblowfish key expansion (4x more work than cost 10). Aims for ~150–350ms per hash in production so attackers cannot brute-force leaked databases.
Explore Related Developer Tools
Password Generator
Generate strong random passwords with custom length, character sets, and bit entropy meter.
Stripe Webhook Signature Verifier
Generate and verify Stripe Stripe-Signature (t=timestamp,v1=hex) HMAC-SHA256 webhook headers over ${timestamp}.${raw_body} in browser.
Hash Generator
Generate MD5, SHA-1, SHA-256, and SHA-512 cryptographic hash digests from text or files.
HMAC Signature Generator
Generate and verify HMAC signatures (HMAC-SHA256, HMAC-SHA512) for Stripe, GitHub, Shopify, and Webhook verification.
Shopify Webhook HMAC Verifier (Base64)
Compute and verify Base64-encoded X-Shopify-Hmac-Sha256 webhook signatures for Shopify orders/create and GDPR webhooks in browser.
GitHub Webhook Signature Tester
Compute and verify GitHub X-Hub-Signature-256 (sha256=<hex>) HMAC-SHA256 webhook headers for push and pull_request events.