Bcrypt Hash & Verify

Bcrypt is a password-hashing function designed to be deliberately slow, which makes brute-force attacks expensive. It automatically includes a random salt, so identical passwords produce different hashes.

The cost (or work factor) controls how slow the hash is. Each step up roughly doubles the time. A cost of 10–12 is a common balance between security and speed.

Switch to verify mode, paste the password and the stored bcrypt hash, and the tool reports whether they match — the same check your application performs at login.

The hash is computed on our server over HTTPS and never stored, but for a password you actually use, prefer generating it in your own environment.

A fast hash like SHA-256 can be guessed billions of times per second, whereas bcrypt is deliberately slow and salted, making large-scale password cracking far more expensive. Use bcrypt for passwords, not a bare fast hash.

A salt is random data mixed into each hash so that identical passwords produce different results and precomputed rainbow tables are useless. Bcrypt generates and stores the salt inside the hash automatically.

The bcrypt algorithm only processes the first 72 bytes of the input, so anything beyond that is ignored. For very long passphrases, some systems pre-hash the input before passing it to bcrypt.

Pick the highest cost your server can tolerate for a login without noticeable delay, commonly around 10 to 12. As hardware improves, raise the cost over time to keep hashing suitably slow for attackers.

Both are strong, slow password hashes. Argon2 is newer and also resists memory-hard attacks, while bcrypt is older and extremely widely supported. Either is a sound choice when configured with a suitable work factor.