Generate and verify bcrypt password hashes online, free and 100% client-side. No server, no logging. Supports configurable cost factor (salt rounds 10-14). Bcrypt encoder, bcrypt password generator, bcryptjs — all in your browser. — runs 100% in your browser, client-side only. No data is sent to any server. Free to use, no account required.
Unlike SHA-256 or MD5, bcrypt is specifically designed for password hashing. It is intentionally slow (configurable via the cost factor) and includes a random salt automatically, making rainbow table attacks and brute-force attacks impractical.
Cost factor guide: 10 = ~100ms, 12 = ~400ms, 14 = ~1.5s. Higher is more secure but slower. For most web apps, 10-12 is the right balance.
Bcrypt is a password hashing function designed specifically for storing passwords securely. Unlike general-purpose hash functions (MD5, SHA-256), bcrypt is intentionally slow — it applies a cost factor that makes brute-force attacks computationally expensive. It also automatically handles salting to prevent rainbow table attacks.
The cost factor (work factor) determines how many iterations bcrypt performs: 2^cost rounds. Cost 10 = 1,024 rounds, cost 12 = 4,096 rounds. A higher cost means slower hashing (harder to brute-force) but also slower login. Cost 10–12 is standard for most applications.
No. Bcrypt is a one-way function. The only way to "crack" a bcrypt hash is by trying candidate passwords one by one — which the cost factor makes intentionally slow (e.g., 100 ms per attempt at cost 10).
The original bcrypt algorithm only processes the first 72 bytes of input. Passwords longer than 72 characters are silently truncated. For very long passwords, pre-hash with SHA-256 before bcrypt if needed.
Bcrypt is an adaptive password hashing function based on the Blowfish cipher. Unlike MD5 or SHA-256, it is intentionally slow with a configurable cost factor (salt rounds), making brute-force and rainbow table attacks impractical. The cost factor controls the number of iterations as 2^cost — so each increment doubles the computation time. Cost factor 12 is the 2026 OWASP minimum recommendation; 13–14 is preferred for new systems where hardware budget allows.
Most online bcrypt tools send your password to a server, exposing it to logging, interception, or misuse. CipherKit runs entirely in the browser using the bcryptjs library — your password never leaves your device. This makes it ideal for developers testing password hashing, verifying bcrypt hashes against known values, or learning how the algorithm works without any privacy risk.
Bcrypt is the right choice for password storage in databases — you should never store plaintext passwords. Use a bcrypt hash generator when building authentication systems, or when configuring a bcrypt password encoder such as Java Spring Security's BCryptPasswordEncoder. It's also essential when verifying bcrypt hashes during migration from weaker algorithms like MD5 or SHA-1. Developers working with node bcrypt or bcryptjs libraries can use this tool for bcrypt online testing before production implementation, validating outputs and cost factor timing without writing boilerplate code.
| Algorithm | Speed | Salt | Recommended For |
|---|---|---|---|
| Bcrypt | Slow (adjustable) | Built-in | Password hashing |
| MD5 | Very fast | No | Checksums only (not passwords) |
| SHA-256 | Fast | No | Data integrity, not passwords |
| Argon2id | Slow (memory-hard) | Built-in | Modern password hashing |