bcrypt only uses the first 72 bytes of a password, so everything after that is ignored (Laravel and PHP behave the same way).
4,096 rounds
All three work the same way. Laravel writes $2y$.
—
Check a password against a hash
Hashing runs in your browser. Nothing you type is sent anywhere, but do not paste a live production password into any website you do not control.
Use this bcrypt hash generator to turn a password into a salted $2y$ hash that Laravel, PHP, Node, Python and most other frameworks accept. Pick the cost factor, generate, and paste the result into your database, seeder or config file.
How to use the Bcrypt Hash Generator
- 1 Type or paste the password you want to hash.
- 2 Set the cost factor (12 is the Laravel default) and choose the prefix your framework expects.
- 3 Click Generate hash and copy the result. To test an existing hash, use the check box underneath.
Formula
bcrypt hash = $2y$ + cost + salt (22 characters) + hash (31 characters) work = 2^cost rounds of the Blowfish key schedule only the first 72 bytes of the password are used
Worked examples
Input: Password: secret, cost 12, prefix $2y$
Result: $2y$12$ followed by 53 random-looking characters
A new random salt is used every time, so the same password gives a different hash, and Hash::check accepts them all.
Input: Password: secret, cost 4
Result: A 60-character hash starting $2y$04$
Cost 4 is the minimum: fine for tests and seeders, too weak for real accounts.
What is a bcrypt hash?
Bcrypt is a password-hashing function built on the Blowfish cipher. It adds a random salt to every password, so two users with the same password get different hashes, and it is deliberately slow, so guessing passwords from a stolen database is expensive. A bcrypt hash is always 60 characters, for example $2y$12$ followed by a 22-character salt and a 31-character hash.
Laravel hashes passwords with bcrypt by default (Hash::make, configured in config/hashing.php), and so does PHP's password_hash(). A hash made here can be pasted straight into a users.password column, a database seeder or a factory.
How to choose the right cost factor
The cost factor is an exponent: every +1 doubles the work. Cost 12 means 2^12 = 4,096 rounds.
| Cost | Rounds | Roughly, on a typical server |
|---|---|---|
| 10 | 1,024 | 50–100 ms |
| 12 | 4,096 | 200–400 ms (Laravel's default) |
| 14 | 16,384 | 0.8–1.5 s |
Pick the highest cost at which logging in still feels instant, usually 250–500 ms on your production server, and raise it as hardware gets faster. Laravel lets you set it with BCRYPT_ROUNDS in .env. This page runs in JavaScript, which is slower than PHP, so the same cost takes longer here than on your server.
Using the hash in Laravel and PHP
- Laravel:
Hash::make('secret')produces the same kind of hash. Check one withHash::check('secret', \$hashedPassword). - PHP:
password_hash('secret', PASSWORD_BCRYPT, ['cost' => 12])andpassword_verify(). - Node, Python, Ruby, Go: choose the
$2b$prefix; every mainstream bcrypt library reads all three prefixes.
The $2y$, $2b$ and $2a$ prefixes
The prefix is a version marker. $2y$ is what PHP and Laravel write, $2b$ is what OpenBSD and most other languages write, and $2a$ is the older form. For ordinary passwords all three produce the same bytes, so they are interchangeable.
Limits worth knowing
- Only the first 72 bytes of a password are used. Longer passwords are cut off, which is how bcrypt itself works.
- A hash cannot be reversed. To test a password, hash it again with the same salt, which is what the check box does.
- Bcrypt is for passwords. Use SHA-256 for checksums, and consider Argon2 if your framework supports it.
Frequently asked questions
Is this bcrypt hash compatible with Laravel?
Yes. The tool writes standard $2y$ hashes, and they are accepted by Laravel's Hash::check and PHP's password_verify. The output of this generator was verified against PHP's own password_hash.
Why is the hash different every time for the same password?
Each hash gets a fresh random 16-byte salt, and the salt is stored inside the hash. That is why two hashes of the same password look unrelated but both verify correctly.
Which bcrypt cost factor should I use?
Use 12 unless you have a reason not to; it is Laravel's default. If you can, measure on your production server and choose the highest cost where a login still takes about 250 to 500 milliseconds.
Can I decrypt a bcrypt hash back to the password?
No. Bcrypt is a one-way function. The only way to test a password is to hash it again with the same salt and compare, which the "Check a password against a hash" box does for you.
Is my password sent to a server?
No. The hash is calculated in your browser, in a background worker, and nothing is uploaded or stored. Still, avoid typing a live production password into any website you do not control.
What is the difference between $2y$ and $2b$?
Nothing for ordinary passwords: both are the same algorithm with different version labels. Use $2y$ for PHP and Laravel and $2b$ for most other languages.
Related tools
JSON Formatter & Validator
Format, beautify, minify and validate JSON with syntax highlighting, key sorting and precise error locations.
Base64 Encoder
Encode text to Base64 (UTF-8 safe), with URL-safe and MIME line-wrapping options.
Base64 Decoder
Decode Base64 and URL-safe Base64 back to UTF-8 text, with clear errors for invalid input.
URL Encoder / Decoder
Percent-encode or decode URLs and query parameters, as a component or a full URI.
HTML Entity Encoder / Decoder
HTML entity encoder and decoder: escape special characters to entities, or decode named and numeric entities back to text.
Regex Tester
Regex tester for JavaScript regular expressions: live match highlighting, capture groups and replace preview.