Bcrypt
Hash a password with bcrypt, or check a string against an existing bcrypt hash.
Loading tool…
About the bcrypt
Hashes a password with bcrypt at the cost factor you choose, or checks a candidate string against a hash you already have. The salt is generated fresh each time, which is why hashing the same password twice gives two different results — both still verify.
Frequently asked questions
Why does the hash change every time?
Bcrypt embeds a random 16-byte salt in the output. That is what stops one rainbow table from cracking every account at once. Verification reads the salt back out of the stored hash.
What cost factor should I use?
Pick the highest number your server can absorb at peak login traffic — typically 10 to 12. Each increment doubles the work, so 12 is four times slower than 10.