bcrypt hash
Hash a password with bcrypt, on your device. For password storage, not for hashing files.
Runs on your device. The file is never uploaded.
bcrypt hash runs a password from the option box through bcrypt at the cost factor you choose, 10 by default, over a 16-byte salt from crypto.getRandomValues. The result is the standard encoded string, which carries that cost and salt. A cost outside 4 to 31 is refused, and there is no file input, so this hashes typed text alone.
Questions
What settings does it use?
bcrypt from hash-wasm, with a cost factor you choose, default 10, and a 16-byte random salt from crypto.getRandomValues. The output is the standard encoded string, the $2b$10$ form, which carries the cost and the salt with it. There is no file input; the password comes from the option box on the page.
What cost factor should I set?
The tool accepts whole numbers from 4 to 31 and refuses anything else with "cost must be a whole number 4-31". The default is 10, and each step up doubles the work. Remember that the work happens in this browser tab, so a high cost makes the page sit and think, and the same cost will behave differently on your server hardware.
Why do I get a different hash every time?
The salt is freshly random on each run, so the same password never produces the same string twice. That is intended: it defeats precomputed tables and hides the fact that two accounts share a password. To check a password against an existing hash, use bcrypt verify rather than comparing two strings.
Can I hash a file with it?
No. There is no file input at all; the only inputs are the password text and the cost factor. bcrypt is built to be slow on purpose, which suits password storage and is wrong for checking a file. For a file digest use Generate all hashes, or HMAC if you need a keyed value.
Should I use bcrypt or Argon2?
This site offers both and does not rank them. What it can tell you is what each one costs here: bcrypt has one knob, the cost factor, so it scales CPU time only. Argon2id hash has three, iterations, memory in KiB and parallelism, so it also forces an attacker to spend memory. Match whatever your existing system already stores.
Does the password go anywhere?
No. hash-wasm runs as WebAssembly in a Web Worker in this tab. The password never leaves the page, is not stored, and there is no account or server behind the tool. The site works offline after the first visit, so you can hash with the network disconnected.