🛡️ Bcrypt Hash & Compare

Using Bcrypt Hash & Compare

Generate a bcrypt hash for a test user or seed script, or check whether a password matches a hash taken from a database while debugging a login.

How to use it

1. On Generate Hash, type the password into Plaintext Password.
2. Choose Salt Rounds: 8 (Faster), 10 (Recommended Standard) or 12 (High Security). Each step up roughly doubles the hashing time.
3. Click Generate Bcrypt Hash and copy the Resulting Hash, which begins with $2 followed by the cost.
4. To check a login, open Verify Hash, paste the stored hash and the candidate password, then click Compare & Verify.

Worked example

Input and settings

Hash the same sample password twice at 10 rounds, then verify it against both hashes.

Expected result

Two different strings starting with $2 and the cost 10, because each has a random salt; both comparisons report a match.

Limits and common mistakes

• bcrypt is one-way: there is no way to recover a password from its hash, only to test candidates against it.
• Only the first 72 bytes of a password are used, and accented or non-Latin characters take several bytes each, so long passphrases may be cut short.
• Pasted hashes are accepted only with a cost from 4 to 12, to stop a hostile hash from freezing the page.
• Test with sample credentials; do not paste real users' passwords from production into any website.

Found a mismatch? Report a problem with a non-sensitive example. Read our privacy information before sharing inputs or links.