>_devtools

Password Hash Generator (bcrypt, Argon2, scrypt, PBKDF2)

Hash and verify passwords with bcrypt, Argon2id/i/d, scrypt or PBKDF2. Tune every parameter, see the encoded string explained, and keep the password in your browser.

What this does

Hashes a password with a deliberately slow, salted password hashing function and writes the standard encoded string, or checks a password against an existing encoded hash. Supported: Argon2id, Argon2i, Argon2d, bcrypt, scrypt, and PBKDF2 with SHA-256, SHA-512 or SHA-1. After hashing, the string is taken apart and each field is explained.

Which one to use

  • Argon2id is the current recommendation (RFC 9106, OWASP). It is memory-hard, which makes GPU and ASIC attacks expensive. Defaults here: 19 MiB, 2 passes, 1 lane.
  • scrypt is also memory-hard and a good choice where Argon2 is not available. Defaults: N=2^17, r=8, p=1.
  • bcrypt is old but still sound at cost 10 or more. It silently ignores everything after 72 bytes of the password, and the tool warns you when that happens. Default cost: 12.
  • PBKDF2 is the FIPS-approved option. It uses almost no memory, so it needs many iterations: 600,000 for SHA-256, 210,000 for SHA-512.

Fast hashes such as SHA-256 or MD5 are not password hashes; see the note in thehash generator.

Salts, caps and speed

A fresh random 16-byte salt comes from the browser's secure random generator for every hash, and it is stored inside the encoded string. Work runs in a background worker with a progress bar and a cancel button. Parameters are capped (bcrypt cost 15, 256 MiB of memory, 10 million PBKDF2 iterations) so a typo cannot freeze your tab; the same caps apply to the parameters of any hash you verify. Browser JavaScript is several times slower than native code, so timings here will not match your server.

Encoded formats

bcrypt writes $2b$12$salt+hash. Argon2 writes the PHC string$argon2id$v=19$m=19456,t=2,p=1$salt$hash. scrypt writes$scrypt$ln=17,r=8,p=1$salt$hash and PBKDF2 writes$pbkdf2-sha256$i=600000,l=32$salt$hash, all with unpadded Base64. To inspect a hash you already have, use the password hash inspector.

Privacy

The password never leaves this tab: it is held in memory, hashed in a worker, and not saved or sent anywhere. Still, do not type a real production password into any website you do not control.