About this tool
The Bcrypt Hash Generator & Verifier produces and checks bcrypt password hashes without ever sending your password to a server. Bcrypt, designed by Provos and Mazières in 1999, wraps the Eksblowfish key schedule in an adaptive work factor: the cost parameter sets 2^cost key-setup rounds, so raising the cost makes every guess exponentially slower for an attacker while staying cheap for a single legitimate login. Generate mode reads 16 random salt bytes from the browser's crypto.getRandomValues, runs the Eksblowfish setup at your chosen cost, encrypts the 192-bit "OrpheanBeholderScryDoubt" constant 64 times, and emits the standard Modular Crypt Format string $2b$NN$ + 22-char base64 salt + 31-char base64 digest.
The algorithm runs as an eval-free WebAssembly build of bcrypt loaded locally, so nothing is uploaded and the tool works offline once loaded. Bcrypt only considers the first 72 bytes of the password — the tool warns you when your input exceeds that limit so you are never surprised by silent truncation. The cost factor is selectable from 4 to 16 (default 10); each step doubles the work, so 12 is four times slower than 10.
Verify mode parses the $2b$/$2a$/$2y$ prefix, the two-digit cost, and the embedded salt out of an existing hash, recomputes the digest with the candidate password, and reports match or no-match. Because the salt and cost travel inside the hash string itself, you only need the password and the stored hash to check a login. Everything is computed in-page — passwords are hashed 100% in your browser and nothing is uploaded.