Bcrypt Generator & Verifier

Bcrypt is an adaptive password-hashing function published by Niels Provos and David Mazières in 1999. It is based on the Blowfish cipher's expensive key setup, deliberately tuned to be slow. The cost parameter controls how slow — every increment doubles the work factor, so an attacker who could brute-force a cost-10 hash in 1 hour needs ~1024 hours for the same password at cost 20.

Bcrypt is automatically salted (16-byte random salt embedded in the output), survives 25+ years of cryptanalysis without weakening, and is implemented in every major language. OWASP recommends bcrypt cost ≥ 10 for new password storage in 2026.

$2y$10$N9qo8uLOickgx2ZMRZoMye   IjZAgcfl7p92ldGxad68LJZdL17lhWy
└┬┘ └┬┘ └────────┬────────┘   └──────────────┬───────────────┘
 │   │           │                            │
 │   │           │                            └─ 31 chars: bcrypt checksum
 │   │           └─ 22 chars: base64 salt (16 raw bytes)
 │   └─ Cost: 10 → 2^10 iterations
 └─ Prefix: bcrypt variant identifier

The total length is always 60 characters. The prefix + cost + salt is enough to verify any password against the hash, so you only need to store the single 60-char string in your database.