Bcrypt Hash & Verify

Bcrypt is the industry-standard password hashing algorithm for web applications. Unlike SHA-256 or MD5 (which are fast and can be brute-forced), bcrypt is intentionally slow due to its configurable cost factor (the number of key-expansion rounds). A cost factor of 10 means 2^10 = 1,024 rounds; factor 12 means 4,096 rounds.

This tool uses the bcryptjs library — a pure-JavaScript implementation that runs in the browser without any server. You can hash a password and get the bcrypt string (which includes the salt and cost factor), or verify whether a plain-text password matches a stored hash. The same algorithm is used by password_hash() in PHP, BCrypt in Spring Security, and the bcrypt package in Node.js.

Note: bcrypt is slow by design. Higher cost factors (12–14) are more secure but take longer to compute. Factor 10 is the practical minimum for production; factor 12+ is recommended for modern hardware.