What You're Typing Into a Bcrypt Tool
Testing or debugging bcrypt hashing usually means typing an actual password into the tool — sometimes a real user's password, sometimes a test credential that resembles your production password policy. If an online tool sends that input to a server to compute the hash, the plaintext password leaves your device in the process, regardless of how briefly.
How This Tool Keeps Everything Local
This Bcrypt tool computes hashes entirely using WebAssembly running inside your own browser tab — a compiled, near-native-speed implementation of the bcrypt algorithm executing locally on your device. Nothing you type is sent to a server. This is verifiable, not just a stated claim.
- Check the Network tab: open your browser's developer tools, watch the Network panel, and generate or verify a hash — you won't see your password sent out in a request.
- Disconnect from the internet after the page loads, and use the tool anyway — it still works, since no server round-trip is involved.
Why WebAssembly Specifically
Bcrypt's deliberate computational cost — the entire point of the algorithm — means it needs to run reasonably fast locally to remain practical for interactive use. WebAssembly lets this tool run a proper, standard bcrypt implementation at near-native speed directly in your browser, rather than a slower JavaScript reimplementation or, worse, offloading the computation to a server.
Why This Matters Especially for Password Testing
Developers testing authentication systems often use real or near-real passwords to debug login issues. Client-side computation means there's no server log of what you typed, no third-party retention policy to evaluate, and the password never leaves your own browser throughout the entire process.
Need to hash or verify a password without sending it anywhere?
Use Bcrypt Tool Safely