Important BCrypt behavior
BCrypt only uses the first 72 bytes of a password. This tool shows the real UTF-8 byte count and warns when the limit is exceeded.
PHP
One way only
Default Cost: 12
Generate BCrypt Hash
The original password is sent only to your own PHP API and is never written to logs.
UTF-8 bytes0 / 72
Only the first 72 bytes are used by standard BCrypt.
Higher cost is slower and harder to brute force. Runtime grows approximately exponentially.
Each generated hash uses a new random salt.
Nonstandard convention for long passwords. Verification must use the same mode.
Result
Your generated BCrypt hashes will appear here.
Verify Password
This password is checked against the BCrypt Hash below. UTF-8 bytes: 0
Supports valid BCrypt hash formats accepted by the PHP runtime.
Nonstandard convention for long passwords. Verification must use the same mode.
Inspect BCrypt Hash
Parses version, cost, 22-character salt and 31-character checksum without exposing a password.
Check Whether a Hash Needs Rehashing
Enter the existing BCrypt Hash whose cost policy you want to evaluate.
Uses PHP password_needs_rehash to compare the existing hash with your target policy.
BCrypt Cost Benchmark
Measure BCrypt hashing time on this NAS or server and estimate a practical cost.
Benchmark is CPU intensive. Use it when server load is low.
First Cost value to measure.
Last Cost value to measure.
Number of measurements averaged for each Cost.
Maximum average time used to recommend a Cost.
The benchmark uses a fixed internal test password and never uses your entered passwords.
Batch BCrypt Generation
Up to 20 passwords. Blank lines are ignored.0 / 20
The same Cost is applied to every password in this batch.
Nonstandard convention for long passwords. Verification must use the same mode.