Runs entirely in your browser — nothing leaves this page.
bcrypt / htpasswd
Hash generation fully client-side, WASM under the hood.
10
Generating bcrypt hashes
bcrypt is a deliberately slow password hash with the salt embedded in the output, which is why two hashes of the same password never match. The cost factor sets how slow: each step doubles the work.
The hash and the optional htpasswd line are produced in your browser, so the password never leaves the page.
The same page verifies an existing hash against a password, which is the quickest way to confirm that a stored credential and the one a user typed really do match.
Which cost factor should I use?
High enough that one hash takes roughly 250 ms on the hardware doing the verification — commonly 12 today. Too low and offline cracking is cheap; too high and your login endpoint becomes a denial-of-service surface against yourself.
Why do I get a different hash every time?
Because a fresh random salt goes into each one, and it is stored inside the hash string. Verification re-reads that salt, so comparison works even though the strings differ. A password hash that produced identical output every time would be a defect.
Does bcrypt have a length limit?
Yes, 72 bytes. Anything beyond that is ignored, silently. If you accept long passphrases, pre-hash with SHA-256 before bcrypt, or use argon2id instead.
Should I use bcrypt for new systems?
argon2id is the current recommendation where you can choose. bcrypt remains a perfectly reasonable choice, is available everywhere, and is what htpasswd and many existing stacks speak.
Related tools: Password generator, Password leak check and JWT decoder.