What is bcrypt?
bcrypt is a password-hashing function designed to be intentionally slow and to include a per-password salt automatically. Its cost factor can be increased over time to keep pace with faster hardware.
This slowness is a feature: it makes brute-force and rainbow-table attacks far more expensive. bcrypt (or alternatives like Argon2) should be used for storing passwords — never a fast hash like MD5 or SHA-256 alone.
Key points
- Designed to be intentionally slow to resist brute-force attacks.
- Includes a per-password salt automatically.
- The cost factor can be raised over time as hardware speeds up.
- The salt and cost are stored inside the hash string itself.
Example
$2b$12$R9h/cIPz0gi.URNNX3kh2OPST9/PgBkqquzi.Ss7KIUgO2t0jWMUW
Common uses
- Hashing user passwords for storage
- Verifying a password at login
- Replacing insecure fast hashes for credentials
- Storing any secret you only ever need to compare, not read
Work with bcrypt directly in your browser.
Open the Bcrypt Hash & Verify