How to Hash a Password with Bcrypt

2 min read by Mohammad Shoeb

How to Hash a Password with Bcrypt

Storing passwords as plain MD5 or SHA-256 is a mistake that gets databases dumped and accounts cracked. Those hashes are built to be fast, which is exactly what an attacker wants. Bcrypt is built to be slow and salted on purpose, and that is what makes it the right tool for passwords.

Why bcrypt and not MD5 or SHA-256

Fast hashes like MD5 and SHA-256 are great for checksums and integrity checks. They are wrong for passwords, because their speed lets an attacker try billions of guesses per second against a stolen hash.

Bcrypt does two things differently:

  • It is deliberately slow. Each hash takes real time to compute, so brute-force guessing crawls instead of races.
  • It salts automatically. A random salt is generated and baked into every hash, so identical passwords produce different hashes and precomputed rainbow tables are useless.

You do not manage the salt yourself. Bcrypt handles it for you.

What the cost factor means

The cost factor (also called the work factor or rounds) controls how slow the hash is. It is a power of two, so each time you raise the cost by one, you double the work needed to compute the hash.

  • A cost of 10 means 2^10 iterations, a cost of 12 means 2^12, and so on.
  • Common values today are 10 to 12, balancing security against the time your server can spare per login.
  • As hardware gets faster, you raise the cost to keep pace.

Pick a cost high enough that a single hash takes a noticeable fraction of a second, but not so high that logins feel sluggish.

How the salt lives inside the hash

A bcrypt hash is not just the digest. The full $2b$ string encodes everything needed to verify a password later, packed together:

$2b$12$R9h/cIPz0gi.URNNX3kh2OPST9/PgBkqquzi.Ss7KIUgO2t0jWMUW

Reading left to right: 2b is the algorithm version, 12 is the cost factor, the next 22 characters are the salt, and the rest is the hash itself. Because the salt and cost travel with the hash, you store one string and nothing else.

Hash and verify a password

Here is how to use the Bcrypt Generator:

  1. Open the Bcrypt Generator and type or paste the password.
  2. Choose a cost factor (10 to 12 is a sensible default).
  3. Generate the hash and copy the full $2b$ string to store in your database.
  4. To check a login, switch to verify mode, paste the stored hash and the password attempt, and the tool reports whether they match.

Everything runs in your browser. The password and the hash never leave your device and are never sent to a server.

Hash with bcrypt, store the whole string, and let the slowness do its job.

SecurityDeveloper ToolsHow-to

← All posts