Bcrypt Hash Generator
Generate a secure bcrypt hash for passwords.
Was this tool helpful?
Thanks for the feedback!
This Bcrypt Hash Generator creates a password hash with PHP's password_hash() function using the bcrypt algorithm at cost 10. Developers use it to set a password directly in a database, seed an admin account, or produce test fixtures for login code. Type the password, press Generate bcrypt, and copy the 60-character result.
Reading a bcrypt hash
A hash produced by this page looks like this:
$2y$10$wrtlcZ.TfdNXIC1IPY4NEuqTNd/187zxLwuq.zP8JvR/pytnhHWey| Part | Value | Meaning |
|---|---|---|
| Prefix | $2y$ | bcrypt, PHP's label for the fixed variant |
| Cost | 10$ | 2 to the power 10, i.e. 1,024 rounds of key setup |
| Salt | next 22 characters | random, new on every click |
| Hash | last 31 characters | the result itself |
Because the salt is random, pressing the button twice for the same password gives two different hashes. Both are correct. The salt and cost are stored inside the string, which is why a verifier needs nothing except the hash and the password someone types.
Checking a hash in your code
In PHP, password_verify('MyS3cret!', $hash) returns true for a hash made from MyS3cret!. Laravel's Hash::check() uses the same routine. Libraries in other languages usually treat $2y$ and $2b$ as the same algorithm. To set a password by hand in MySQL, generate the hash and run something like UPDATE users SET password = '$2y$10$…' WHERE email = 'admin@example.com';, pasting the full 60 characters.
Limits you should know
- 72-byte ceiling. Bcrypt only looks at the first 72 bytes. A password of 72 "a" characters and the same string with "EXTRA" appended produce hashes that verify each other. Hindi and other Indic scripts use three bytes per character in UTF-8, so the limit arrives after about 24 characters.
- Edge spaces are removed. The server trims spaces and line breaks at the start and end of the input before hashing, so a password that really begins or ends with a space will not match the hash.
- Fixed cost. The work factor is always 10. Laravel's default is now 12, which is four times slower to compute; a cost-10 hash still verifies there, and the framework can rehash it at the user's next login.
Why bcrypt instead of MD5 or SHA-256
Fast hashes are built to process gigabytes per second, which also lets an attacker test billions of guesses. Bcrypt is deliberately slow and salted, so identical passwords don't share a hash and precomputed tables are useless. The OWASP Password Storage Cheat Sheet accepts bcrypt with a work factor of 10 or more where Argon2id isn't available. A fast checksum like the MD5 Hash Generator is fine for file fingerprints but never for passwords.
This runs on the server: your text travels over HTTPS to PHP and the hash comes back, so for live production passwords it is better practice to hash inside your own application. For choosing a strong password first, try the Password Generator.