consolelog.tools logo

Bcrypt Hash Generator

Learn about bcrypt and use PBKDF2 for browser-based password hashing

Bcrypt Cannot Run in the Browser

Bcrypt requires native code and cannot be implemented purely in JavaScript. For browser-based password hashing, use PBKDF2 (see the PBKDF2 tab).

About Bcrypt

Bcrypt is an adaptive password hashing function designed to be slow and computationally expensive, making it resistant to brute-force attacks. It uses the Blowfish cipher and includes a salt to protect against rainbow table attacks.

Example Format

$2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy

Advantages

  • Adaptive: Cost factor can be increased as computers get faster
  • Salted: Includes random salt to prevent rainbow table attacks
  • Slow by design: Resistant to brute-force attacks
  • Well-tested: Used in production for over 20 years
  • Cross-platform: Implementations available in many languages

Limitations

  • Cannot run in browser: Requires native implementation
  • Maximum password length: 72 bytes (truncates longer passwords)
  • Not the newest: Newer alternatives like Argon2 may be preferred
  • Blocking operation: Computationally intensive, blocks event loop

Recommended Cost Factor

Cost factor determines the number of iterations (2^cost). Higher values are more secure but slower. Cost of 12 takes ~250ms on modern hardware.

Minimum: 10
Recommended: 12
High Security: 14
Cost 10: ~60ms
Cost 12: ~240ms
Cost 14: ~960ms

Browser Alternatives

PBKDF2

Browser Compatible

Password-Based Key Derivation Function 2. Supported by Web Crypto API, can run in browser.

Recommendation: Good choice for browser-based password hashing. Use at least 100,000 iterations with SHA-256.

Argon2

Winner of Password Hashing Competition (2015). More secure than bcrypt, resistant to GPU/ASIC attacks.

Recommendation: Best choice for server-side hashing. Requires native implementation or WebAssembly.

scrypt

Memory-hard key derivation function. More resistant to hardware brute-force attacks than bcrypt.

Recommendation: Good alternative to bcrypt. Requires native implementation or WebAssembly.

Was this tool helpful?

Share Your Experience

Help others discover this tool!

Share on Twitter

Frequently Asked Questions - Bcrypt Hash Generator