# Bcrypt Generator & Checker - Argon2, scrypt, PBKDF2 Hashes

> Generate and verify password hashes online: bcrypt (cost 4–14, $2a/$2b/$2y), Argon2id, scrypt and PBKDF2, auto-detecting PHP, Django, Flask and passlib formats.

- URL: https://qilingtools.com/en/bcrypt
- Category: Developer Tools (https://qilingtools.com/en/dev)
- Tags: [Privacy & Security](https://qilingtools.com/en/tags/privacy), [Developer](https://qilingtools.com/en/tags/dev)
- Last updated: 2026-10-26
- Price: Free, no sign-up
- Privacy: Runs locally in the browser; files are never uploaded

Building a login, migrating a user table or debugging a “the password is right but login fails” bug often means generating or checking a password hash on the spot. This tool creates hashes with the four mainstream algorithms: bcrypt (cost 4–14 with a $2b$, $2y$ or $2a$ prefix), Argon2 (Argon2id / 2i / 2d with adjustable memory, iterations and parallelism), scrypt (N, r, p) and PBKDF2 (HMAC-SHA1/256/512). The output formats match PHP’s password_hash, Django, Flask/Werkzeug and passlib, and the elapsed time is shown so you can judge cost settings for your server. To verify, paste the hash string and the password: the format and parameters are detected automatically and the hash is recomputed with the same salt. bcrypt, scrypt and Argon2 are implemented in pure TypeScript and were cross-checked against OpenBSD test vectors, PHP, Node.js and Python; PBKDF2 uses the browser’s native WebCrypto. Work runs in a background Web Worker, so high settings never freeze the page and you can cancel at any time. Passwords and hashes are never uploaded or stored.

## How to use

1. Pick an algorithm, type the password and adjust cost, memory and output format
2. Click Generate, then copy the hash and check how long it took
3. Switch to Verify password, paste a hash and a password, and the format is detected for you

## Features

- bcrypt: cost 4–14, $2a$ / $2b$ / $2y$, warning past 72 bytes
- Argon2id / Argon2i / Argon2d (RFC 9106) with memory, iterations and parallelism
- scrypt (RFC 7914) with a memory estimate
- PBKDF2-HMAC-SHA1/256/512 via WebCrypto
- PHP, Django, Werkzeug / Flask and passlib hash formats
- Automatic format and parameter detection
- Background Web Worker with progress and cancel
- Timing shown to help choose cost parameters

## FAQ

### What bcrypt cost should I use?

Each +1 doubles the work. OWASP recommends at least 10, and 10–12 is common; a practical target is roughly 100–300 ms per hash on your server, and you can get a feel for the timing here (browsers and servers differ). Note that bcrypt only uses the first 72 bytes of a password — anything after that doesn’t change the hash, and the tool warns you about it.

### What’s the difference between $2a$, $2b$ and $2y$?

The algorithm is the same; the prefixes mark historical bug fixes. $2a$ is the early version, $2y$ is what PHP adopted after fixing a flaw in its implementation, and $2b$ is OpenBSD’s marker after fixing a length overflow with very long passwords. For passwords up to 72 bytes all three produce the same result and generally verify interchangeably. $2b$ is recommended for new systems (PHP outputs $2y$).

### Should I pick bcrypt, Argon2, scrypt or PBKDF2?

For new projects choose Argon2id (OWASP suggests starting at m = 19 MiB, t = 2, p = 1): it’s both memory- and time-hard, which resists GPU cracking best. bcrypt has the most mature ecosystem and is available in almost every language; scrypt is memory-hard as well; PBKDF2 is mostly for FIPS compliance and needs a high iteration count (600,000+ for SHA-256). Never store passwords with fast hashes such as MD5 or plain SHA-256.

### Why is the hash different every time for the same password?

A new random salt is generated each time and stored inside the hash string together with the parameters. Verification reads the salt and parameters back out, recomputes, and compares, so many different hash strings can belong to the same password. That’s the point of salting: identical passwords never share a hash in your database, which defeats rainbow tables.

## Related tools

- [JSON Formatter](https://qilingtools.com/en/json): Free online JSON formatter: beautify or minify, validate with the exact line and column of any error, browse a collapsible tree, sort keys and escape strings.
- [Base64 Encode/Decode](https://qilingtools.com/en/base64): Free online Base64 encoder and decoder: UTF-8 safe, optional URL-safe variant, convert text to Base64 and back in real time. Processed locally, never uploaded.
- [URL Encode/Decode](https://qilingtools.com/en/url-encode): Free online URL encoder and decoder with encodeURIComponent and encodeURI modes. Escapes Chinese, spaces and special characters. Real-time and local, no upload.
- [JWT Decoder](https://qilingtools.com/en/jwt): Free online JWT decoder: decode the header and payload of a JSON Web Token, show expiry and issued-at times, all locally without uploading the token.
- [Timestamp Converter](https://qilingtools.com/en/timestamp): Free online Unix timestamp converter: convert timestamps and dates, auto-detect seconds or milliseconds, and show local, UTC, ISO 8601 and relative time.
- [Hash / Checksum](https://qilingtools.com/en/hash): Free online hash calculator: SHA-1, SHA-256, SHA-384 and SHA-512 of text or any file through the browser crypto API. Files never leave your device.
- [UUID Generator](https://qilingtools.com/en/uuid): Free online UUID generator: create RFC 4122 UUID v4 in bulk with a cryptographic RNG. Options for uppercase, no hyphens and braces, with one-click copy.
- [Base Converter](https://qilingtools.com/en/base-convert): Free online number base converter: convert between binary, octal, decimal, hexadecimal and any base 2–36. Uses BigInt for huge integers, computed locally.