How to Generate and Verify a Bcrypt Hash: Step-by-Step Guide

Generating a Hash

1. Enter the password you want to hash.
2. Set the cost factor if the tool exposes it (a higher number means slower, more secure hashing — more on this below).
3. Generate. The tool outputs a bcrypt hash string, which includes the algorithm version, cost factor, and salt all bundled together with the hash itself.

Verifying a Password Against a Hash

1. Paste the existing bcrypt hash you want to check against.
2. Enter the plaintext password you're testing.
3. Verify. The tool confirms whether that password produces a match against the given hash — a simple yes or no, nothing more.

Why Verification Works Without "Decrypting" Anything

Bcrypt hashing is one-way — there's no operation that turns a hash back into the original password. Verification works differently: the tool re-hashes the plaintext password you provide (using the same cost factor and salt embedded in the existing hash) and checks whether the result matches. If the passwords are identical, the hashes match; if not, they won't. This is why verification requires both the hash and a plaintext password to test — never just the hash alone.

A Note on the Salt

Each bcrypt hash embeds its own random salt, generated at hash time. This is why hashing the same password twice produces two completely different-looking hash strings — and it's expected, not a bug. Both hashes are still valid; each one just used a different random salt.