Skip to content
en es

Bcrypt & Argon2 Hash Generator

Create bcrypt or Argon2id password hashes with the cost you choose, or check whether a password matches a hash. It runs in a background worker in your browser.

Runs in your browser — nothing is uploaded.

Generate a hash

This password is longer than 72 bytes. bcrypt cannot hash it faithfully; choose Argon2id or a shorter password.

4 to 14. Each step doubles the time.

$2y$ is what PHP writes. The algorithm is the same.

19456 KiB is about 19 MiB. Up to 262,144.

Working…

Copied

Verify a password

A bcrypt ($2a$, $2b$, $2y$) or Argon2 hash.

How to use it

  1. Enter the password, pick bcrypt or Argon2id and set the cost (rounds) or memory, then press Generate.
  2. Copy the hash into your database or seed file.
  3. To check a password, enter it with the hash in the Verify section. Both formats are recognised.

Frequently asked questions

Is my password uploaded?

No. The hash is computed in your browser with WebAssembly, inside a background worker. This page loads no ads, analytics or third-party scripts, and nothing you type is logged. Still, do not paste a live production password into any website; use a test one.

Is it compatible with PHP and Laravel?

Yes. The default $2y$ prefix is the one PHP’s password_hash() writes, and password_verify() accepts these hashes (and the reverse). Argon2id hashes use the standard $argon2id$ format PHP produces with PASSWORD_ARGON2ID.

Which cost should I use?

Each +1 doubles the time. Pick the highest your server can afford, aiming for roughly 250 ms per hash; 10 to 12 is typical today. The page shows how long your browser took.

Which Argon2id settings?

OWASP’s minimum is 19 MiB of memory, 2 iterations and 1 lane (the defaults here); 46 MiB with 1 iteration is an equivalent alternative. More memory is stronger.

Why is a password longer than 72 bytes refused?

bcrypt only uses the first 72 bytes, so everything after would be silently ignored. Use Argon2id, or pre-hash the password in your application.

Why is each hash different for the same password?

A random salt is generated every time and stored inside the hash. Verification reads it back, so every valid hash of the password verifies.

Related tools

Hash Generator Calculate MD5, SHA-1, SHA-256, SHA-384, SHA-512, SHA-3, CRC32 and xxHash of text or a file in your browser. Large files are streamed. Compare against a checksum. Password Generator Generate strong random passwords in your browser: 1 to 500 at once, any length, custom symbols, no ambiguous characters. Nothing is sent or stored. Password Strength Checker Check how strong a password is in your browser: pattern-aware score, estimated crack times and tips. Optional breach check sends only 5 characters of a hash.