A bcrypt hash cannot be "decrypted": to find out whether a password is correct, use Verify mode. Everything is computed in your browser and the password is never sent to any server.
Current version. Generated by OpenBSD, Node.js, Python, Go and Rust.
Each cost point doubles the computation time. OWASP recommends at least 10; ideally, use the highest value your server can compute in about 250 ms.
How it works
bcrypt is a hash function designed for storing passwords. Unlike SHA-256 or MD5, which are computed in microseconds, bcrypt is deliberately slow: that way, anyone who steals a database needs years to try passwords by brute force.
Each hash stores everything needed to verify it: the algorithm version, the cost and a random 128-bit salt. That is why the same password gives a different hash every time and the salt does not need to be stored separately.
The cost is the base-2 logarithm of the number of rounds: a cost of 10 computes 1024 rounds and a cost of 12, 4096. Raising it by one point doubles the computation time, which lets you keep up with faster hardware without changing algorithms.
Examples
rasmuslerdorf$2y$10$.vGA1O9wmRjrwAVXD98HNOgsNpDczlqm3Jq7KnEd1rVAGv3Fykk1aThe password_verify() example from the PHP manual: paste it in Verify mode with that password and it matches.abc$2a$06$If6bvum7DFjUnE9p2uDeDu0YHzrHM6tf.iqN8.yx.jNN1ILEf7h0iA jBCrypt test vector with cost 6. The first 22 characters after the cost are the salt; the remaining 31 are the checksum.Use cases
- Create the hash of an admin user's initial password to insert it directly into the database.
- Check whether a password matches the stored hash when a user cannot log in.
- Generate test hashes for fixtures, seeds or automated tests of a Laravel, Spring, Django or Node.js application.
- Measure how long each cost takes to choose the right value before configuring it on the server.
- Create entries for Apache .htpasswd files, which accept bcrypt hashes with the $2y$ prefix.
Frequently asked questions
Can a bcrypt hash be decrypted?
No. bcrypt is a one-way function: there is no way to recover the password from the hash. The only option is to try candidate passwords and see whether any of them matches, which is exactly what bcrypt makes slow.
What is the difference between $2a$, $2b$ and $2y$?
All three compute the same thing for normal passwords. $2a$ is the original version; PHP introduced $2y$ in 2011 to tell its hashes apart from those of a buggy implementation; OpenBSD adopted $2b$ in 2014 when fixing another bug with passwords longer than 255 characters. Almost every library accepts all three when verifying.
What cost should I use?
OWASP recommends at least 10. Ideally, use the highest value your server can compute in about 250 ms per login. Spring Security uses 10 by default; Laravel 11 and PHP 8.4 raised theirs to 12.
Why does bcrypt ignore anything beyond 72 bytes?
The algorithm uses the password as a Blowfish key, which supports up to 72 bytes. Anything beyond that is silently discarded, so two passwords that share the first 72 bytes produce the same hash. Accented characters and emojis take up two to four bytes, which is why the tool counts bytes rather than characters.
Is bcrypt or Argon2 better?
Argon2id is the recommended algorithm for new systems today because, besides being slow, it uses a lot of memory, which makes GPU attacks more expensive. Even so, bcrypt is still secure with an appropriate cost and is the default in PHP, Laravel, Spring and Ruby on Rails.
Is my password sent to any server?
No. The hash and the verification are computed in your browser and the password never leaves your device; it is not included in the link for sharing the tool either.