Password hashes, tried and checked.
Make bcrypt, Argon2id and scrypt password hashes with the settings you choose, see how long each takes, and check a password against a stored hash.
By Suraj KumarUpdated 4 min read
Passwords are stored as slow hashes, so that a stolen database is costly to crack. Choosing how slow means trying the settings, and debugging a login means checking a password against what is stored.
Make one, see how long it takes.
Open the bcrypt generator, type a test password, choose bcrypt, Argon2id or scrypt, and make the hash: it is written as it is stored ($2a$…, $argon2id$…, $scrypt$…) with a new random salt each time, and the page says how long it took on this device. The settings start at OWASP's recommendations: bcrypt cost 10, Argon2id with 19 MiB, 2 passes and 1 lane, scrypt with N = 2^17.
bcrypt reads only the first 72 bytes of a password; the page says so when a password is longer.
Check a stored hash.
Paste a stored hash and the settings it was made with are read from it: bcrypt's cost, Argon2's memory, passes and lanes, scrypt's N, r and p. Type a password and Check says whether it is the one the hash was made from. Other kinds, such as Linux's $6$, are named.
Nothing leaves your browser.
Hashes are made and checked on your device, and nothing you type is sent or kept. Still, this is for trying settings and debugging: use test passwords, and let your own server hash real ones.
Further reading
Topics: bcrypt generator · bcrypt checker · argon2 hash · argon2id · scrypt · password hashing · verify bcrypt hash
A little less theory. A little more doing.
Try it on your own terms, with a free browser tool.
Try the tool