What is bcrypt?
Bcrypt is a password-hashing function designed to be slow on purpose. Instead of storing passwords, websites store a bcrypt hash; at login they hash the password typed and compare. Because each guess takes real time, stolen hashes are very hard to crack by brute force, unlike fast hashes such as MD5 or SHA-256.
Reading a bcrypt hash
$2y$12$R9h/cIPz0gi.URNNX3kh2OPST9/PgBkqquzi.Ss7KIUgO2t0jWMUW
$2y$: the version. $2a$, $2b$ and $2y$ are interchangeable in modern libraries.12: the cost. Each step doubles the work: cost 12 takes 4× as long as cost 10.- Next 22 characters: the random salt, so the same password gives a different hash every time.
- Last 31 characters: the hash itself.
Which cost should I use?
Choose the highest cost that keeps a login under about a quarter of a second on your server. In 2024–2026, 10 to 12 is typical; Laravel and PHP default to 10–12, Django uses its own defaults. The timer here shows how long hashing took in your browser, a rough guide to server speed.
Using the hash in your code
| Language | Verify a password |
|---|---|
| PHP | password_verify($pw, $hash) |
| Laravel | Hash::check($pw, $hash) |
| Node.js | await bcrypt.compare(pw, hash) |
| Python | bcrypt.checkpw(pw.encode(), hash.encode()) |
| Java (Spring) | new BCryptPasswordEncoder().matches(pw, hash) |
Good to know
- Bcrypt only uses the first 72 bytes of a password. The tool warns you if yours is longer.
- Hashes can’t be “decrypted”. The only way back is guessing, which bcrypt makes slow.
- Everything happens in your browser. Even so, avoid pasting live production passwords into any website.
Frequently asked questions
Can a bcrypt hash be decrypted?
No. Bcrypt is a one-way hash. The only way to find the password is to guess and compare, which bcrypt deliberately makes slow.
Why do I get a different hash each time?
Each hash uses a new random salt, so the same password produces a different hash every time. All of them verify correctly.
What is the difference between $2a$, $2b$ and $2y$?
They are versions of the same algorithm. $2y$ is PHP’s label and $2b$ is used by OpenBSD and Node.js; modern libraries accept all three.
What cost should I use?
Usually 10 to 12. Pick the highest cost that keeps hashing under about 250 milliseconds on your server.
Is my password sent to a server?
No. Hashing and checking run in your browser with the bcrypt.js library. Nothing is uploaded.
Last updated October 2026 · More developer tools