CRYPTO.03 BCRYPT GENERATOR

Bcrypt Generator

Generate and Verify share one password input while the Hash Inspector explains the result; cost, timing, and the 72-byte boundary stay beside the operation.

PASSWORD

Password and cost

Plaintext password

Cost factor 12

Common compatibility baseline; benchmark production hardware

Enter a password to generate, or paste a hash on the right to verify

Local asynchronous bcrypt.js · passwords and hashes are never uploaded or stored

§ 01

Generate and verify around the same password

Enter a password and check bytes

The classic Bcrypt input limit is 72 UTF-8 bytes. CJK and emoji take multiple bytes, so respond to the warning rather than relying on character count.

Choose a cost

Each increment roughly doubles work. Cost 12 is a common starting point, but the production value must be timed on the real server.

Generate or verify

A generated result automatically fills the Verify field. Verification reads the embedded salt and cost from the complete hash.

§ 02

Bcrypt deliberately slows password guessing

Bcrypt is password hashing, not reversible encryption. Each result contains a version, cost, random salt, and hash payload; a verifier reads the salt directly from the complete string.

A normal login computes once, while an attacker must repeat the expensive work for every guess. Cost should be reviewed as hardware changes without blindly slowing the service.

§ 03

Cost-factor scale and use

Cost

Approx. rounds

Recommendation

4–9

16–512

Local tests and demos

10–11

1024–2048

Legacy or low-power environments

12

4096

Common baseline; benchmark hardware

13–14

8192–16384

Higher cost; evaluate login delay

15

32768

Noticeably slow in a browser

§ 04

The 72-byte limit and version prefix cause common compatibility issues

Traditional Bcrypt uses only the first 72 password bytes. Seventy-two ASCII characters are 72 bytes, but CJK commonly uses three bytes and many emoji use four.

Common prefixes include 2a, 2b, and 2y. Modern output normally uses 2b, while 2y appears in PHP ecosystems. Test real samples with maintained libraries when migrating between languages.

§ 05

Bcrypt generation and verification in multiple languages

import bcrypt from 'bcryptjs';
const hash = await bcrypt.hash(password, 12);
const valid = await bcrypt.compare(password, hash);

§ 06

Frequently Asked Questions

Q1Can Bcrypt be decrypted?

No. Verification recomputes the input with the salt and cost embedded in the hash; a forgotten password should be reset.

Q2Is cost 12 always right for production?

No. It is a common starting point, but select a value through production-hardware benchmarks and consider concurrency, rate limiting, and UX.

Q3Why does the same password produce a different hash?

Each generation uses a new random salt. Different strings can still verify the same password, which prevents rainbow-table and bulk precomputation attacks.

Q4Are passwords uploaded or saved?

No. bcrypt.js computes asynchronously in the current page without sending inputs or writing browser storage.

Q5Should a new project choose Bcrypt or Argon2id?

Both support password storage. New systems commonly evaluate Argon2id first, while Bcrypt remains widespread for framework compatibility and existing data.