MAC Address Generator
Generate MAC addresses that are correctly marked as locally administered.
Hash a password with bcrypt, or check one against an existing hash.
The Bcrypt Generator hashes a password at a cost you choose, or checks a password against an existing hash. The implementation is verified against the output of server-side bcrypt, and runs entirely in your browser.
bcrypt is the password hash to use when you have no strong reason to use Argon2. It is deliberately slow, the cost is adjustable so it can be made slower as hardware improves, and it generates and stores its own salt inside the hash — so two identical passwords never collide.
The cost factor is the whole point. It is a power of two, so cost 12 does four times the work of cost 10. Pick the highest value your server can absorb at your login rate; 12 is a reasonable default in 2024 and takes a few hundred milliseconds. The verify mode is just as useful as generating: paste a hash from your database and a candidate password to confirm the two match, which is the quickest way to debug a login that keeps failing.
Paste a hash from your database and a candidate password to see whether they match — usually faster than adding logging to find out why a login fails.
Choose the work factor and see how long it actually took, so you can pick the highest value your login endpoint can absorb.
$2y$, $2a$ and $2b$ are all supported and all interchangeable, so a hash from PHP verifies against one from Go or Node.
bcrypt truncates at 72 bytes — and bytes, not characters — and the tool warns when a password crosses that line.
The whole algorithm runs in your browser, so a real password is never transmitted.
Hash a new password, or check a password against a hash you already have.
12 is a sensible default. Higher is slower and stronger; the tool shows how long it took.
$2y$ is what PHP writes, $2a$ and $2b$ are what most other languages produce. They are interchangeable.
The 60-character result goes straight into a database column.
The highest your login endpoint can absorb. 12 is a common 2024 default and takes a few hundred milliseconds; 10 is the floor. Measure it on your own hardware rather than guessing.
They mark which implementation wrote the hash after some historical bugs. All three are the same algorithm and verify against each other, so a $2y$ hash from PHP checks fine in a Go or Node library.
Because bcrypt generates a random salt and stores it inside the hash. That is the point — it means two users with the same password get different hashes, so cracking one does not crack the other.
Yes, the input is truncated at 72 bytes, and bytes not characters — so an emoji costs four. If you need long passphrases, pre-hash with SHA-256 before bcrypt, or use Argon2.
What people who use the Bcrypt Generator think of it. Reviews come from visitors and are posted as written.
No ratings yet
Yours would be the first.
0 reviews
Newest first
No reviews yet
Be the first to rate the Bcrypt Generator. It takes half a minute and no account.
Write the first reviewGenerate MAC addresses that are correctly marked as locally administered.
See your own user agent string and what a server can tell from it.
Build an HTTP Basic Authorization header from a username and password.
Validate a JSON document against a draft-07 schema and see every failure by path.
Fill in the fields and get a complete README.md in Markdown.
Generate deterministic UUIDs from a namespace and a name.
Break an emoji into its code points, modifiers and joiners.
Produce SHA-1, SHA-256, SHA-384 and SHA-512 digests of any text.