Bcrypt hash
Hash a password with bcrypt at a chosen cost and get a standard $2b$ hash, or verify a password against an existing bcrypt hash. Runs in your browser — the password never leaves your device.
About this tool
Bcrypt hash hashes a password with bcrypt — the long-standing, adaptive password-hashing algorithm derived from the Blowfish cipher and still widely used across web frameworks and databases. The result is a standard modular-crypt string that embeds the variant, cost, salt and hash, e.g.:
$2b$12$<22-char-salt><31-char-hash>
- Hash mode generates a fresh random salt and returns the hash string. Tune the cost (work factor, 4–31; default 12). Each step up doubles the time it takes to compute — and to crack.
- Verify mode checks a password against a bcrypt hash you paste. The variant and
cost are read from the string itself, so it accepts
$2a$,$2b$,$2x$and the PHP-style$2y$hashes.
Privacy
Everything runs in your browser via WebAssembly — your password is never uploaded to a server. Also available from the gizza CLI and in chat.
Notes
bcrypt only considers the first 72 bytes of a password; longer inputs are rejected here so you don't silently lose data. For new systems, Argon2id or scrypt are generally preferred — but bcrypt remains a solid, battle-tested choice, and you often need it to match an existing hash.
FAQ
Why does the same password give a different hash every time?
Because each hash embeds a fresh random salt — that's how bcrypt is supposed to work. Two hashes of the same password will never match character-for-character. To check a password against an existing hash, use verify mode, which reads the salt and cost out of the hash string and recomputes it.
What cost (work factor) should I pick?
The cost can be 4–31 and defaults to 12. Each +1 doubles the computation time — for hashing and for an attacker cracking it. 10–12 is typical for web logins today; values above ~15 can take seconds per hash in the browser, so raise it gradually.
Why is my long password rejected?
bcrypt only hashes the first 72 bytes of input. Rather than silently truncating (which some libraries do), this tool returns an error for anything longer than 72 bytes so you know exactly what was hashed. If you need longer secrets, pre-hash them (e.g. SHA-256) before feeding bcrypt.
Can it verify $2y$ hashes from PHP?
Yes. Verify mode accepts the $2a$, $2b$, $2x$ and PHP-style $2y$ variant tags —
they all describe the same underlying algorithm, so a password_hash() string from PHP
verifies fine here.
Developer & Automation Access
Run it from the terminal
Same engine as this page, headless — via the gizza CLI:
gizza tool bcrypt-hash "The password to hash or verify"New to the CLI? Get gizza →
Open it by URL
Pre-fill and auto-run this tool with query parameters — the names match the API/CLI:
https://gizza.ai/tools/bcrypt-hash/?password=The%20password%20to%20hash%20or%20verify&mode=hash&hash=%242b%2412%24%E2%80%A6&cost=12Machine-readable descriptor: tool.json — title + parameters JSON Schema for agents.