Hash a password with bcrypt in your browser — pick the cost, verify a hash, and never send the password anywhere.
Runs locally with the vendored bcryptjs library (no CDN). Bcrypt hashes are one-way: a hash cannot be turned back into the password.
bcrypt hash
How to use this tool
Type the password to hash — it never leaves your browser.
Cost 10 is the standard default; 12 is slower and stronger for sensitive accounts.
Store only the hash in your database, never the plain password.
Paste an existing bcrypt hash to check whether it matches the password.
Formula & worked example
Hashing 'hello' at cost 10 gives a $2a$10$ hash that verifies as true for 'hello' and false for any other password.
Limitations — read this before you rely on it
Bcrypt is one-way: a hash cannot be decrypted. Passwords longer than 72 bytes are truncated by classic bcrypt — keep passwords under that limit for this tool. The browser build runs on the main thread, so cost 12 may take a moment.
Frequently asked questions
No. Hashing runs locally in your browser with the vendored bcryptjs library — no CDN, no server.
10 for most apps, 12 for sensitive accounts. Higher costs are stronger but slower.
No. Bcrypt is one-way by design; verification only checks whether a password matches.
Each hash uses a fresh random salt, so identical passwords still get unique hashes — that is a security feature.
The algorithm is production-standard, but real apps should hash on the server, not in the browser. Use this tool for testing and migration.