What's a good bcrypt cost in 2026?

10 is still the OWASP default and a fine starting point for most web apps. Aim for whatever cost takes ~250-500 ms on the slowest hardware that will run your auth code — on modern x86, that lands around 12. Higher cost only helps if it does not crush your login p95; benchmark before bumping.

Why is bcrypt slow on purpose?

A fast hash like SHA-256 lets an attacker try billions of guesses per second against a leaked database. Bcrypt's Eksblowfish key schedule runs 2^cost iterations of an expensive round, so the attacker is rate-limited to the same speed as your server. Cost 10 = 1024 iterations; cost 14 = 16,384.

Is bcrypt still recommended vs argon2 / scrypt?

Argon2id is the modern winner (Password Hashing Competition 2015) and is what OWASP recommends first if you can choose freely. Bcrypt is still acceptable — its 27 years of cryptanalysis with no practical breaks make it the safe-boring choice when your platform does not ship argon2. Scrypt is fine too but less reviewed in the password context.

Why are the same password's hashes always different?

Bcrypt mixes a fresh 128-bit random salt into the hash, so the same password produces a different $2b$...$ string every time. The salt is stored inside the hash itself (the 22 chars right after the cost), which is why verify only needs the password and the full hash — not a separate salt.

Can I migrate MD5 / SHA hashes to bcrypt?

Yes, with a layered scheme. On next login, re-hash the user's plaintext password with bcrypt and replace the stored MD5/SHA. For users who do not log in, you can bcrypt the existing hash (bcrypt(sha256(password))) as a stop-gap, then upgrade to plain bcrypt at next login. Never run bcrypt directly on an MD5 hex string of any user input greater than 72 bytes — bcrypt truncates inputs past 72 bytes.

Bcrypt Generator — Hash and Verify Passwords in Your Browser

bcrypt password hash generator + verifier — pick rounds, hash and compare in browser.

Runs locally
Category Encoding & Crypto
Best for Checking file type, size, metadata, and obvious mismatch signals before sharing.

Runs 100% in your browser. Password and hash never leave this tab.

Password

Cost (rounds): 10(1,024 iterations)

4 (fastest) — 14 (very slow). 10 is the modern default.

Bcrypt hash

—

What this tool does

Free online bcrypt hash generator and verifier. Pick a cost from 4 to 14 (10 is the modern default), type a password, and instantly get a $2b$ bcrypt hash. Switch to verify mode to test whether a password matches an existing $2a$ / $2b$ / $2y$ hash. The full Eksblowfish algorithm runs in pure JavaScript inside your tab — no npm bcrypt dependency, no external API. Generation time scales with cost (cost 14 ≈ a noticeable second on a laptop) so you can feel why bcrypt is deliberately expensive.

Tool details

Input: Numbers; The page exposes text boxes, numeric controls, file pickers, or structured inputs depending on the tool.
Output: Live result + Copy; The result area focuses on usable output, with copy, download, or preview actions when supported.
Privacy: Browser-side processing; The main tool logic does not call an external API, so inputs normally stay in the current tab.
Save / share: No account required; Open the page and use it; whether results survive refresh depends on the tool.
Performance budget: Initial JS <= 30 KB; No WASM budget is declared, keeping the tool quick to open on mobile.
Best fit: Encoding & Crypto · Developer; Category and role tags drive related tools, internal links, and quick fit checks.

How to use

1. Input

Paste or drop your content into the tool panel.
2. Process

Click the button. All processing is local in your browser.
3. Copy / Download

Copy the result or download to disk in one click.

How Bcrypt Generator fits into your work

Use it before upload, handoff, archive, support review, or any moment where a file needs one local check before it leaves your machine.

File jobs

Checking file type, size, metadata, and obvious mismatch signals before sharing.
Preparing mixed folders for upload, archive, intake, or review.
Keeping sensitive files in the browser instead of sending them to an account-based service.

File checks

Do not treat the extension alone as proof of the real file type.
Review metadata before a file goes to customers, vendors, or a public page.
Keep the original file until the copied, converted, or exported result is verified.

Good next steps

These links move the current task into a more complete workflow.

FAQ

Tool combos

Folks in your role tend to reach for these alongside this tool.

Browse all tools for this role

Bcrypt Generator — Hash and Verify Passwords in Your Browser

What this tool does

Tool details

How to use

1. Input

2. Process

3. Copy / Download

How Bcrypt Generator fits into your work

File jobs

File checks

Good next steps

FAQ

Password Generator

Password Strength Checker

MD5 / SHA Hash Generator

JWT Encoder

HTML Entities Encoder

JWT Decoder

Number Base Converter

Color Blindness Simulator

AES Text Encryptor

Atbash Cipher

Base32 / Base58 Encoder & Decoder

Base62 Encoder & Decoder