Skip to content
SP

ScriptPulse

Developer Tools

Security Lab Tools
Password GeneratorPassword AnalyzerJWT InspectorHash GeneratorHMAC GeneratorUUID GeneratorEncryption StudioToken GeneratorBcrypt HasherRSA Key Pair GeneratorOTP Code GeneratorNano ID GeneratorULID GeneratorBIP39 Passphrase GeneratorView all Security Lab tools →

Bcrypt Hasher

Hash text with bcrypt cost factors using browser-side crypto libraries.

Bcrypt Hasher

Runs entirely in your browser

This tool executes locally using standard browser APIs (for example window.crypto.getRandomValues or crypto.subtle where applicable). Your input is not transmitted to or stored on a ScriptPulse server. See How Calculations Work.

No data uploaded

What This Tool Does

  • The Bcrypt Hasher is a browser-first security utility designed to generate cryptographic bcrypt hash strings and verify passwords locally. In modern web development, storing plain-text passwords in databases is a critical security vulnerability. Bcrypt is a key-stretching hashing algorithm designed by Niels Provos and David Mazières based on the Blowfish cipher. It introduces an adaptive cost parameter that controls the calculation rounds, making it highly resistant to hardware-accelerated GPU brute-force attacks.
  • The Hasher prioritizes absolute data safety. Bcrypt operations are calculated client-side in browser memory using JavaScript cryptographic libraries. No passwords, hashes, or cost factors are transmitted to external servers, protecting user credentials and staging passwords from interception.

How It Works

  • The utility reads the password string and cost factor configuration from the input fields.
  • It generates a secure 128-bit salt value locally.
  • The engine runs the Blowfish encryption state loops, repeating the hashing rounds determined by the cost factor (2^cost).
  • The resulting hash digest is compiled into the standard bcrypt string format.
  • The hashed output is rendered in the results editor, with copy and verify triggers enabled.

Usage

  1. Enter the plain text password in the input editor panel.
  2. Set your target cost factor (default is 10, recommended range is 10–12).
  3. Click the 'Hash Password' button to run the local bcrypt calculation.
  4. Copy the generated hash string to seed your database.
  5. Alternatively, use the verify tab to test if a password matches an existing hash.

Examples

  • Generating a standard hash: Translating `secret123` with cost 10 into a `$2a format string.
  • Verifying database passwords: Confirming a candidate string matches an admin hash.
  • Testing cost factor performance: Measuring the calculation time of cost 12 vs cost 10.
  • Building test credentials: Creating hashes to populate seed configurations.

Real-World Use Cases

  • Generating test password hashes to seed databases for local development and staging testing.
  • Verifying candidate passwords against database hashes during administrative console testing.
  • Calculating cryptographic secrets configurations for local authentication systems.
  • Auditing cost parameters to measure server calculation times and security margins.
  • Teaching hashing principles and adaptive cost factors in web security classes.

Best Practices

  • Use a cost factor of at least 10 for standard users, and 12 for administrative accounts.
  • Use constant-time comparison algorithms when verifying bcrypt hashes on the server to prevent timing attacks.
  • Store passwords strictly using slow, resource-intensive algorithms like Bcrypt or Argon2id.
  • Ensure different salt values are generated for every password hash to prevent rainbow table attacks.

Common Mistakes

  • Setting cost factors too high (e.g. 14+), which can cause server timeouts and CPU spikes during authentication.
  • Using fast hashing algorithms (like MD5 or SHA-256) instead of bcrypt for password database storage.
  • Pasting active production passwords into online tools, risking credential leaks.
  • Storing generated hashes in unsecure configurations without access controls.

Limitations

  • Input key sizes are limited to 72 bytes due to Blowfish cipher boundaries; characters beyond this are ignored.
  • High cost factors may freeze the browser tab thread due to client-side CPU constraints.
  • Data is processed in browser memory; reloading the page clears the workspace.

Technical Reference Guide

  • Bcrypt Format: Contains prefix, cost, salt, and digest segments (e.g. `$2a$10$N9qo8uLOTvI5GxVb5Y8uHeXJ5a6K...`).
  • Blowfish Cipher: The symmetric block cipher that forms the basis of the bcrypt algorithm's rounds.
  • Adaptive Cost: Exponents range from 4 to 31, determining the round cycles (`2^cost` iterations).

Specifications & Standards

USENIX Bcrypt Hashing Paper ReferenceOWASP Password Storage Cheat Sheet
Browse the full Standards & References library →

FAQ

  • Is my password secure when using this tool?

    Yes. All calculations are executed locally inside your browser memory using client-side JavaScript. No data is sent to external servers.

  • What do the parts of a bcrypt hash represent?

    A bcrypt hash string consists of four parts separated by '

    #x27;: the prefix algorithm version (e.g., 2a), the cost factor (e.g., 10), a 22-character salt, and a 31-character hash digest.

  • What cost factor should I use?

    A cost factor of 10 is standard for modern CPUs. High-security environments use 12, balancing security against execution time (aiming for ~100-250ms per hash).

  • Why does bcrypt limit passwords to 72 characters?

    Bcrypt is built on the Blowfish cipher, which has a maximum key length of 72 bytes. Any characters past this limit are ignored by the algorithm.

  • Why do I get a different hash every time I hash the same password?

    Bcrypt automatically generates a unique random salt value for every hash calculation. This ensures identical passwords produce different hashes, blocking rainbow table attacks.

  • How do I verify a password against an existing hash?

    Use the 'Verify' tab, paste the plain-text password and the bcrypt hash, and the tool will run the matching algorithm to check if they correspond.

  • What is the difference between Bcrypt and MD5?

    MD5 is a fast hash function that can be cracked quickly. Bcrypt is a slow, resource-intensive key-stretching algorithm designed specifically to resist brute-force cracking.

  • Does the tool support salt customization?

    The tool automatically generates cryptographically secure salts. Customizing salt inputs is not supported to ensure security compliance.

  • Does this tool work offline?

    Yes. Once the page is loaded, the page assets are cached, allowing you to use all tools without an active internet connection.

  • What does the prefix $2a$ or $2b$ represent?

    These prefixes represent algorithm updates that fixed implementation issues in legacy bcrypt libraries. Version $2b$ is standard.

  • Can I decrypt a bcrypt hash?

    No. Hashing is a one-way mathematical function. You cannot retrieve the original password from the hash digest.

  • What is a timing attack in password verification?

    A timing attack occurs when a server rejects invalid passwords at different speeds depending on how many characters match. Constant-time comparisons block this vulnerability.

Part of this Developer Hub

This utility is part of our comprehensive Authentication & Tokens Lab topic workspace.

Explore foundational guidelines, technical specifications, and other interactive utilities related to this workflow.

Related Tools

Explore related utilities inside the Security Lab workshop for complementary engineering workflows.

Password GeneratorPassword AnalyzerToken GeneratorUUID Generator
View all Security Lab tools