What is the difference between $2a$, $2b$, and $2y$ Bcrypt prefixes?

$2a$ is the original specification from OpenBSD. $2y$ was introduced by PHP's crypt_blowfish to denote hashes generated with a corrected algorithm that avoids 8-bit sign-extension bugs. $2b$ is the modern standard released by OpenBSD in 2014, fixing a password length wraparound bug. Modern libraries treat $2b$ as the default and verify $2a$ and $2y$ interchangeably.

Why does Bcrypt have a maximum password length limit of 72 bytes?

The underlying EksBlowfish block cipher truncates password input to 72 bytes during the initial key setup phase. Any characters beyond 72 bytes are completely ignored by standard Bcrypt implementations. Developers handling arbitrary-length passwords should pre-hash passwords with SHA-256 before passing them to Bcrypt.

How does the work factor (cost rounds) affect computation time?

The cost parameter represents a power of two ($2^{\text{cost}}$ iterations). Increasing the cost by 1 doubles the calculation time. For web applications, a cost of 10 to 12 offers an optimal balance between brute-force resistance (approx 200ms to 1s on modern hardware) and server throughput.

Can I verify an existing Bcrypt hash generated by PHP or Python with this tool?

Yes. This tool implements the standard OpenBSD EksBlowfish key schedule and 64-round Blowfish encryption in pure JavaScript. It extracts the algorithm prefix, cost rounds, and 22-character Radix-64 salt from your hash, performs the identical key schedule, and checks for an exact match.

Are passwords or hashes sent to any remote server when using this tool?

No. All calculations are executed entirely within your browser's local JavaScript runtime via Web Workers / Web Crypto. Zero network packets or analytical payloads containing plaintext passwords are ever transmitted.

How can I programmatically verify Bcrypt hashes in Node.js and Python?

In Node.js, use `bcrypt.compareSync(plaintext, hash)` from `bcryptjs` or `bcrypt`. In Python, use `bcrypt.checkpw(plaintext.encode('utf-8'), hash.encode('utf-8'))` from the official `bcrypt` library.

Bcrypt Hash Generator & Verifier Online

Plaintext Password 9 chars

Algorithm Variant & Cost Factor

10 rounds

Result Hash

Calculating...

🔬 Bcrypt Hash Anatomy Breakdown:

Algorithm

$2b$

Cost Rounds

10 (1,024 iters)

Radix-64 Salt (22 chars)

...

Output Length

60 characters

Frequently Asked Questions

Is Bcrypt Hash Generator & Verifier free to use?

Yes, Bcrypt Hash Generator & Verifier is completely free with no signup or registration required. All processing happens directly in your browser.

Is my data safe?

Absolutely. Your data never leaves your device. Everything runs locally in your browser — no uploads, no servers, no tracking.

Do I need to install anything?

No installation needed. Bcrypt Hash Generator & Verifier works entirely in your web browser on both desktop and mobile devices.

How do I use

Simply enter or paste your input in the tool above, and the result will be generated instantly. No configuration required.

Frequently Asked Questions

Explore More Free Developer & DevOps Utilities