How do I hash a password online?

Type the password above, pick a cost (rounds 4–15), and run the tool. It generates a salted PBKDF2-HMAC-SHA256 hash with a fresh random salt — free, no signup, processed entirely in your browser. Note: this produces PBKDF2 hashes, not Blowfish bcrypt hashes.

Is this a real bcrypt generator?

No — and that is stated deliberately. This tool uses PBKDF2-HMAC-SHA256 (via the audited noble-hashes library), not the Blowfish-based bcrypt algorithm. A correct pure-JavaScript bcrypt needs the full Blowfish constant tables; a subtly-wrong "bcrypt" would be dangerous. PBKDF2-HMAC-SHA256 with unique salts and high iteration counts is an NIST-recommended password-hashing construction.

Why is the hash different every time for the same password?

Because each run generates a fresh 16-byte random salt. That is correct behavior for password hashing — it means two users with the same password get different stored hashes, so a leaked database cannot be attacked with precomputed rainbow tables.

What do the rounds mean?

Rounds set the work factor: iterations = 2^rounds × 100. Rounds=10 gives 102,400 PBKDF2 iterations; rounds=15 gives about 3.3 million. Higher rounds slow down brute-force attacks but also slow down your own login checks — 10–12 is the usual balance.

Can I verify a password against one of these hashes?

Yes, with your own code: parse the $pbkdf2-sha256$iterations$salt$hash format, re-run PBKDF2-HMAC-SHA256 with the stored salt and iteration count, and compare the derived key in constant time. Never compare password hashes with a simple == in security-critical code — use a constant-time comparison.

Password Hash Generator — PBKDF2 Hashing Online

What is Bcrypt generator?

Bcrypt Generator — Hash passwords with this free password hash generator — PBKDF2-HMAC-SHA256 with per-hash random salt, honestly labeled (not Blowfish bcrypt). Runs in your browser, nothing uploaded.

PBKDF2-HMAC-SHA256 via the vendored noble-hashes library (MIT), exactly as the library documents it: pbkdf2(sha256, password, randomSalt, {c: iterations, dkLen: 32}). Rounds map to iterations as 2^rounds × 100 (rounds=10 → 102,400 iterations). Each run generates a fresh 16-byte random salt, so the same password produces a different hash every time — this is expected and correct. Everything runs client-side; nothing is uploaded. HONEST LIMITATION: this is NOT Blowfish-based bcrypt — the output identifier is $pbkdf2-sha256$, never $2a$/$2b$, so it cannot be mistaken for a bcrypt hash. A correct pure-JS bcrypt requires the full Blowfish constant tables; shipping a subtly-wrong "bcrypt" would be worse than an honest, audited PBKDF2. PBKDF2-HMAC-SHA256 with a unique salt and high iteration count is an NIST-recommended (SP 800-63B) password-hashing construction.

Why use this bcrypt generator?

🎯

Built for bcrypt generator

Hash passwords with this free password hash generator — PBKDF2-HMAC-SHA256 with per-hash random salt, honestly labeled (not Blowfish bcrypt). Runs in your browser, nothing uploaded.

📋

Transparent & honest

Output is PBKDF2-HMAC-SHA256, NOT bcrypt — the $pbkdf2-sha256$ identifier is deliberately distinct from $2a$/$2b$.

🔒

Private by design

Everything runs in your browser. Your inputs never leave your device.

📱

Works everywhere

Fully responsive — perfect on desktop, tablet, and mobile. No app needed.

🔄

Regularly updated

Regularly maintained and reviewed to ensure accuracy.

💡

Free forever

No accounts, no limits, no watermarks. Use Bcrypt Generator as much as you need.

How to use Bcrypt Generator

1Type the password you want to hash into the "Password" field.
2Set the cost (rounds 4–15, default 10) — higher rounds mean more PBKDF2 iterations and slower hashing.
3Run the tool to generate a salted PBKDF2-HMAC-SHA256 hash with a fresh random salt each time.
4Copy the hash in $pbkdf2-sha256$ format for storage or comparison in your own systems.
5Read the honesty note below before using the output anywhere security-critical.

What can you do with Bcrypt Generator?

Bcrypt hash generator online — Hash passwords with this free password hash generator — PBKDF2-HMAC-SHA256 with per-hash random salt, honestly labeled (not Blowfish bcrypt).
Hash password bcrypt — Hash passwords with this free password hash generator — PBKDF2-HMAC-SHA256 with per-hash random salt, honestly labeled (not Blowfish bcrypt).
Bcrypt cost factor — Hash passwords with this free password hash generator — PBKDF2-HMAC-SHA256 with per-hash random salt, honestly labeled (not Blowfish bcrypt).
Password hashing tool — Hash passwords with this free password hash generator — PBKDF2-HMAC-SHA256 with per-hash random salt, honestly labeled (not Blowfish bcrypt).

Good to know

Output is PBKDF2-HMAC-SHA256, NOT bcrypt — the $pbkdf2-sha256$ identifier is deliberately distinct from $2a$/$2b$.
Salt randomness comes from the platform CSPRNG (crypto.getRandomValues) via noble-hashes; on platforms without it, randomness quality degrades.
Client-side hashing demonstrates the construction but real applications should hash on the server — never trust a hash computed in the user’s browser for authentication.

How it works

PBKDF2-HMAC-SHA256 via the vendored noble-hashes library (MIT), exactly as the library documents it: pbkdf2(sha256, password, randomSalt, {c: iterations, dkLen: 32}). Rounds map to iterations as 2^rounds × 100 (rounds=10 → 102,400 iterations). Each run generates a fresh 16-byte random salt, so the same password produces a different hash every time — this is expected and correct. Everything runs client-side; nothing is uploaded. HONEST LIMITATION: this is NOT Blowfish-based bcrypt — the output identifier is $pbkdf2-sha256$, never $2a$/$2b$, so it cannot be mistaken for a bcrypt hash. A correct pure-JS bcrypt requires the full Blowfish constant tables; shipping a subtly-wrong "bcrypt" would be worse than an honest, audited PBKDF2. PBKDF2-HMAC-SHA256 with a unique salt and high iteration count is an NIST-recommended (SP 800-63B) password-hashing construction.

Examples

Hash a passphrase (default cost)

Status: ok — returns a $pbkdf2-sha256$102400$… hash with a fresh random salt; running twice gives different hashes.

Low cost for speed

Status: ok — 1,600 iterations; fast but weaker. Use higher rounds for real password storage.

Rounds out of range

Status: error — rounds must be between 4 and 15.

People also search for these — this tool handles them all:

bcrypt generatorbcrypt hash generator onlinehash password bcryptbcrypt cost factorpassword hashing tool