Password Hasher &
Hash Generator

Password hashing is a one-way cryptographic function that converts plaintext into a fixed-length string. Unlike encryption, it cannot be reversed — you can only verify a match by hashing and comparing. This is how secure applications store passwords.

Use bcrypt or Argon2. These are deliberately slow algorithms designed to resist brute-force attacks. Never use MD5 or SHA-1 for passwords — they can be cracked in seconds with modern GPUs.

MD5 produces a 128-bit (32 hex) hash and is cryptographically broken. SHA-256 produces a 256-bit (64 hex) hash and remains secure for integrity checks. Neither should be used alone for password storage.

A salt is a random value added to a password before hashing. It ensures identical passwords produce different hashes, preventing rainbow table attacks. bcrypt handles salt automatically.

Yes. All hashing runs in your browser via JavaScript and the Web Crypto API. No data is sent to any server. You can disconnect from the internet and it still works.

The cost factor (work factor) determines how expensive bcrypt is to compute. It's a power of 2: cost 10 = 1,024 iterations. Higher = slower = harder to crack. Cost 10–12 is recommended. Each +1 doubles time.

Hashes have characteristic lengths: MD5 = 32 hex, SHA-1 = 40, SHA-256 = 64, SHA-512 = 128. bcrypt starts with $2a$/$2b$/$2y$ and is 60 chars. Use the Identify tab to auto-detect.