Enter a test password in the hash panel, choose a cost between ten and fourteen, and generate a bcrypt hash. Copy the entire result, including its prefix and salt, into the verification panel. Enter the same password there and run Verify to check the match. The worked example below uses a known complete hash; generation will produce another salt and therefore another string.
Read the cost in the hash prefix when comparing results. Increasing the cost increases work exponentially, so measure it in your actual server environment rather than relying on browser timing. Bcrypt considers at most the first 72 password bytes, which matters for long Unicode passwords. Use this page to inspect the format and test verification; choose production password handling through your application's authentication library.
Verify password: password
Hash: $2b$10$N9qo8uLOickgx2ZMRZoMye8fOsiTWZqYtkxvXkKm8BMzjT7t/vIdq
Result: match
Bcrypt is a salted password hashing function with a configurable work factor. Unlike fast digests such as MD5 or SHA, it is designed to make repeated password guesses expensive. Keep the complete encoded hash because it carries the salt and cost needed for verification. Choose password storage through an established authentication library in your application.
The cost controls work exponentially: increasing it by one roughly doubles the hashing work. This interface allows costs 10–14. Benchmark in your actual authentication environment rather than relying on browser timings. A higher cost slows both legitimate verification and guessing; choose a value your service can support under expected concurrent load.
Both are modern password hashing algorithms. Bcrypt is battle-tested (25+ years) and widely supported. Argon2 won the Password Hashing Competition (2015) and is more resistant to GPU attacks by using memory-hardness. Argon2id (the recommended variant) combines Argon2i and Argon2d for resistance to both side-channel and GPU attacks. For new applications, Argon2id is the preferred choice.
Hashing and verification run locally in your browser. This interface does not offer account saving or server sharing. Use test passwords when exploring bcrypt behavior, and keep actual credentials in your application’s authentication system. Copying a hash uses your clipboard, so consider other software with clipboard access before copying sensitive material.
Processing runs in your browser. Saving and sharing are optional, require an account, and send your chosen content to our service.