Seguretat i criptografia
Generador de hashes bcrypt en línia
Genera hashes bcrypt o verifica una contrasenya contra un hash existent. Bcrypt és hashing unidireccional, no xifratge reversible.
Bcrypt generator
Bcrypt guide
What is bcrypt?
Bcrypt is a password hashing function with a random salt and configurable cost. It is deliberately slow so password guessing is more expensive.
What is bcrypt cost?
Cost controls the computational work required for hashing. A higher value increases resistance to brute-force attacks but also consumes more server CPU and time.
Why is every hash different?
Bcrypt generates a cryptographically secure random salt for every hash. Never provide or reuse a manual salt.
Can bcrypt be decrypted?
No. Bcrypt is not encryption and cannot be decrypted or reversed. Verification hashes the supplied password and compares it safely with the stored hash.
The 72-byte limit
Traditional bcrypt has an effective input limit of about 72 bytes, not 72 characters. UTF-8 accents and emojis may use multiple bytes, so this tool reports both counts and warns without silently truncating.
Bcrypt, SHA-256 and Argon2
Fast hashes such as MD5, SHA-1 or plain SHA-256 are not direct substitutes for password hashing. PHP may also provide Argon2, a modern alternative that should be configured and benchmarked appropriately.
Frequently asked questions
Bcrypt questions
How do I generate a bcrypt hash?
Open Generate, enter the password, select a cost and submit the form. PHP creates the salt and hash natively.
How do I verify a bcrypt password?
Open Verify, enter the original password and the complete bcrypt hash, then select Verify.
Why does the same password generate different hashes?
Each operation uses a new random salt. Different hashes are expected and can all verify the same password.
Which bcrypt cost should I use?
Cost 12 is a reasonable starting point, but measure your own production hardware and choose a response time your service can support.
Can bcrypt be decrypted?
No. It is a one-way password hash. You verify a candidate password; you do not recover the original password from the hash.
What does $2y$ mean?
It identifies a bcrypt hash variant. The following number is the cost and the remaining encoded value contains the salt and hash.
Does bcrypt have a length limit?
Traditional bcrypt processes approximately the first 72 bytes. UTF-8 characters do not always occupy one byte.
Is bcrypt better than SHA-256 for passwords?
Bcrypt is designed to be slower and salted for password storage. A plain fast SHA-256 hash is generally not an equivalent replacement.
What is the difference between bcrypt and Argon2?
Both are password hashing algorithms. Argon2 can offer modern memory-hard settings when PHP supports it; bcrypt remains broadly compatible.
Is my password stored?
No permanent password storage is used. The password is processed for the request and is not placed in URLs, cookies, analytics or local storage.