Bcrypt

THE PRACTICAL GUIDE · NORMANDIN SYSTEMS

Get more from Bcrypt

Bcrypt: Hash and compare text string using bcrypt. Bcrypt is a password-hashing function based on the Blowfish cipher. Bcrypt’s encoded form carries information needed by a verifier, and its work factor changes the computational cost of checking a password. Password hashing deliberately makes verification more expensive than an ordinary fast digest. Its parameters balance the cost of legitimate logins against resistance to offline guessing, so settings should be chosen with the target application’s performance and security requirements in mind. A salt distinguishes otherwise identical passwords, while algorithm and cost information allow later verification. Use sample values when exploring the format and verify compatibility with the library that will actually store or check credentials. A browser-generated example is useful for learning and integration tests, not a complete account-security design.

Guide updated October 13, 2026

How to use this tool

1. Begin with a representative input. For a practical test, use: A sample password and a selected bcrypt work factor. Replace demonstration values only after you understand the output.
2. Enter a demonstration password and set the algorithm parameters required by your target application or test scenario.
3. Generate the hash and examine the encoded algorithm, salt, and cost information where the output includes those fields.
4. Check verification using the intended application library, including both the correct password and a deliberately incorrect one.

SEE IT IN PRACTICE

A worked example

A sample password and a selected bcrypt work factor

A bcrypt hash, or a match result when checking an existing hash

Different salts can produce different bcrypt strings for the same password, so use the compare operation instead of string equality.

Parameters are part of the stored credential

Password verification needs more than a digest-looking string. The verifier must know the construction, salt, and work parameters. Encoded password-hash formats often carry these together. Argon2 includes variant and resource-cost choices, while bcrypt exposes a logarithmic work factor. Compare like-for-like settings when testing, and check how the destination library handles unsupported or malformed encodings.

Plan verification and future upgrades

A login system should verify through a trusted password-hashing library rather than by recomputing an unrelated fast hash. When policy changes, applications often upgrade a stored hash after a successful verification using current settings. Test correct passwords, incorrect passwords, non-ASCII text, and length boundaries. The browser tool helps inspect formats, while the production library defines the authoritative behavior.

When this tool is useful

• Generate bcrypt test fixtures
• Check a sample password hash
• Compare work-factor behavior

Tips for a better result

• Bcrypt implementations have password-length constraints measured in bytes; verify your application’s behavior for long or non-ASCII inputs.
• Do not reuse the demonstration password shown in an example as a real account password.
• Benchmark password-hashing settings in the actual server environment rather than assuming browser timing predicts production login cost.

Frequently asked questions