Password Hasher
Hash a password with bcrypt or PBKDF2 — the algorithms actually meant for password storage — and verify a plaintext password against an existing hash.
About the Password Hasher
General-purpose hash functions like SHA-256 are built to be fast — which is exactly the wrong property for password storage, since it lets an attacker with a stolen hash database try billions of guesses per second. bcrypt and PBKDF2 are deliberately slow, tunable algorithms designed specifically to resist that kind of brute-force attack; see the Hash Generator's notes on why MD5/SHA-256 alone are the wrong tool for this job.
bcrypt bakes a random salt into every hash automatically, so identical passwords never produce identical hashes, and its cost factor can be raised over time as hardware gets faster. PBKDF2 does the same job by repeating (iterating) an underlying hash function thousands of times, and is the one of the two natively supported by the browser's Web Crypto API, with no external library required.
How to use it
- 1Choose Hash to create a new hash, or Verify to check one.
- 2Pick bcrypt or PBKDF2 and set the cost/iteration count.
- 3Copy the resulting hash, or read the verify result.
Features
- bcrypt with configurable cost factor
- PBKDF2-SHA256 with configurable iterations, via the Web Crypto API
- Verify mode: check a password against an existing hash
- Nothing you type is uploaded — hashing runs locally
Frequently asked questions
Why not just use SHA-256 for passwords?
SHA-256 is fast by design, which is good for checksums but bad for passwords — it lets an attacker test billions of guesses per second against a stolen hash. bcrypt and PBKDF2 are deliberately slow to make that infeasible.
What is a cost factor / iteration count?
A tunable number that controls how much work the algorithm does per hash. Higher is slower to compute (and slower to brute-force) — the setting should be the highest your application can tolerate for a single login.
Does bcrypt need a separate salt?
No — bcrypt generates and embeds a random salt in its output automatically, which is why two hashes of the same password always look different.
Is this safe to use for a real production password?
The hashing itself runs correctly and entirely in your browser with nothing transmitted, but treat any password you type into any web page as exposed to that browser session — this tool is best for testing, learning, and generating hashes for seed/test data, not pasting a real live credential.