Why does this tool use PBKDF2 instead of real bcrypt for hashing?

bcrypt relies on a native binary and is not available in the browser environment. PBKDF2 is supported by the Web Crypto API, so it is used as the in-browser hashing alternative. The tool can still inspect existing bcrypt hashes that you paste in — it just cannot generate them client-side.

How many PBKDF2 iterations should I use?

More iterations make hashing slower for everyone, including attackers. OWASP recommends 600,000 or more for PBKDF2-SHA256 (2023 guidance). The tool shows a rough time-to-hash estimate as you change the count so you can pick a value that is strong but still acceptable for your login latency.

What is in the generated hash string?

The full hash is self-describing: it embeds the algorithm, the iteration count and the salt alongside the derived digest. You store that single string, and verification later re-derives the hash using the embedded parameters — there is no need to track the salt and iterations separately.

What does Inspect bcrypt show me?

Paste a bcrypt hash and it parses the algorithm variant ($2a, $2b or $2y), the cost factor (with 2^cost expanded to the number of rounds and an estimated compute time), the salt and the digest, and tells you whether the format is valid — without needing the original password.

Are my passwords stored or transmitted?

No. Passwords entered for hashing or verification stay in memory only for the lifetime of the page; they are never written to local storage and never sent to a server. The mode, iteration count and any pasted bcrypt hash may be remembered locally, but plaintext passwords are not.

Can I verify a bcrypt hash against a password here?

Verification in this tool works against PBKDF2 hashes it generates, not bcrypt. For bcrypt hashes you can use Inspect mode to read their parameters, but checking a password against a bcrypt hash requires a bcrypt implementation on the server side.

Bcrypt / PBKDF2 Generator

Hash and verify passwords with PBKDF2 in your browser (Web Crypto), plus inspect bcrypt hashes. Passwords never leave your machine.

About this ToolHow it works, benefits & use cases

Hash and verify passwords in the browser, and inspect bcrypt hashes you paste in. Because real bcrypt needs a native binary and cannot run in a browser, this tool uses PBKDF2 via the Web Crypto API as the in-browser alternative for hashing. In Hash mode you enter a password and choose an iteration count (the tool shows a rough time-to-hash estimate and notes OWASP's 600,000+ recommendation for PBKDF2-SHA256); it returns a full self-describing hash string that embeds the algorithm, iteration count, salt and digest, plus the salt and hash broken out separately. Verify mode checks a password against a stored PBKDF2 hash and reports match or no-match. Inspect mode parses any bcrypt hash ($2a/$2b/$2y), surfacing its algorithm variant, cost factor (with the 2^cost round count and an estimated compute time), salt and digest, and validates the format. Recommended cost guidance and a comparison of algorithm choices round it out. Passwords are never persisted and never leave your machine.

How to Use

1Pick a mode: Hash (PBKDF2), Verify, or Inspect bcrypt.
2In Hash mode, enter the password, set the iteration count (watch the time estimate and OWASP note), and click "Generate hash".
3Copy the full hash string to store — it embeds the salt and iterations — or grab the salt and digest separately.
4In Verify mode, enter a password and paste the stored PBKDF2 hash, then click "Verify password" for a match/no-match result.
5In Inspect bcrypt mode, paste a bcrypt hash to see its variant, cost factor, salt and digest, with format validation.

Key Benefits

In-browser password hashing with PBKDF2 via the Web Crypto API
Self-describing hash output that embeds algorithm, iterations and salt for easy storage
Configurable iteration count with a live time-to-hash estimate and OWASP guidance
Verify mode to confirm a password against a stored PBKDF2 hash
Inspect bcrypt hashes: variant, cost factor, 2^cost rounds, salt and digest
Recommended cost-factor guidance and an algorithm comparison (bcrypt, PBKDF2, others)
Passwords stay in memory only — never persisted or uploaded

Common Use Cases

Generating a PBKDF2 password hash to store for a side project or prototype
Verifying that a candidate password matches a previously generated PBKDF2 hash
Decoding a bcrypt hash from a database to read its cost factor and salt
Checking whether a bcrypt cost factor is high enough by its estimated compute time
Comparing iteration counts to balance security against hashing time

bcrypt can't run in a browser (needs a native binary). This tool uses PBKDF2 via the Web Crypto API as the in-browser alternative, and can inspect bcrypt hashes you paste. Passwords stay in memory only.

Generate PBKDF2 hash

Password (not saved)

Iterations: 100,000 · ~50ms to hash

OWASP recommends 600,000+ for PBKDF2-SHA256 (2023)

Algorithm choices

PBKDF2browser

Password-Based Key Derivation Function 2. Supported by Web Crypto API, can run in browser.

Argon2

Winner of Password Hashing Competition (2015). More secure than bcrypt, resistant to GPU/ASIC attacks.

scrypt

Memory-hard key derivation function. More resistant to hardware brute-force attacks than bcrypt.

Was this tool helpful?

Share Your Experience

Help others discover this tool!

Share on

Bcrypt / PBKDF2 Generator

How to Use

Key Benefits

Common Use Cases

Generate PBKDF2 hash

Algorithm choices

Was this tool helpful?

Share Your Experience

Related tools

Frequently Asked Questions - Bcrypt Hash Generator