Bcrypt Generator
Articles, guides, and in-depth tips for the Bcrypt Generator — everything you need to get the most out of it.
✦ AI-powered — understands natural language
Argon2id Won the Password Hashing Competition — Here's Why Memory-Hardness Matters and When to Migrate From bcrypt
bcrypt Work Factors Double With Each Increment — Here's How to Choose the Right One and Upgrade Existing Hashes
bcrypt's work factor doubles hashing time for every increment — work factor 10 is ~100ms, work factor 12 is ~400ms, work factor 14 is ~1.6 seconds. This exponential relationship is the design feature, not a side effect: when hardware gets faster, incrementing the work factor by 1 restores the original time cost. Here's how to choose the right factor, the opportunistic re-hash strategy for upgrading existing hashes without forcing logout, and how to read the work factor from a stored bcrypt hash string.
Bcrypt's 72-Byte Limit: Why Two Different Passwords Can Hash to the Same Value
Bcrypt silently truncates input at 72 bytes — meaning two passwords sharing the same first 72 bytes but differing afterward produce the identical hash. Here's why 72 specifically, how multi-byte Unicode characters (emoji especially) reach this limit far sooner than "72 characters" suggests, why pre-hashing with SHA-256 is a common mitigation, and why this isn't actually a meaningful security concern for typical passwords.
Credential Breaches and Stuffing Attacks: What Leaked Password Databases Reveal and How HIBP Works
Have I Been Pwned has indexed 12+ billion breached accounts. Here's what a leaked credential database actually looks like, how attackers use credential stuffing at scale, the k-anonymity trick that lets HIBP check passwords without seeing them, and why bcrypt salting defeats rainbow tables.
Why bcrypt: The History of Password Hashing, Cost Factors, and When Argon2 Is Better
SHA-1 and MD5 are fast by design — which is why GPUs crack them in hours after a breach. bcrypt's deliberate slowness and automatic salting are its defence. Here's how bcrypt works, the 72-byte limit, choosing a cost factor, and when Argon2 is the better choice.
Bcrypt Generator — Hash & Verify Passwords the Right Way
Learn how bcrypt works, why slowness is the feature, what the cost factor means, how to use bcrypt for user authentication, and why MD5 and SHA-256 should never be used for passwords — with a free bcrypt generator.
Bcrypt Generator — How to Hash & Verify Passwords Correctly
Learn what bcrypt is, how the cost factor and salt work, how bcrypt hashes are structured, and how to use a free bcrypt generator to test and verify password hashes in your development workflow.
