All tools

Bcrypt generator

Make and check bcrypt, Argon2 and scrypt password hashes, and read a stored hash's settings. Free, with no account or uploads.

Make or check a password hash

Try bcrypt, Argon2 and scrypt settings and see how long each takes on this device, or check a password against a stored hash.

Try one

Everything happens in your browser: what you paste or open is never sent anywhere, and nothing is kept when you leave.

How it works and help

A little help along the way

Follow these steps. Every option is explained underneath. Everything happens in your browser; nothing you paste is sent anywhere.

  1. Paste anythingPaste text into the box at the top. The toolkit says what it may be (Base64, Base64url, Base32, hex, percent-encoding, HTML character references, Unicode escapes, a punycode domain, a data URL, text hiding characters) and why it thinks so. Press a guess to open it with the steps that read it.
  2. Or build a recipeOpen the toolkit, type or paste your input, or open a file, and add steps from the list on the left (on a phone, Add a step). Each step works on what the one before gave, so URL decode then Base64 decode reads Base64 that was put in an address.
  3. Set each step's optionsEach step shows its options: the Base64 alphabet and padding, which characters URL encoding keeps, whether HTML references are written by name or number, the escape style for your language. Move a step up or down or remove it.
  4. Read the notesA step says what it let pass, such as line breaks a Base64 decode passed over or a % that was not followed by two hex digits. When a step cannot go on, it says why and where, and the steps after it wait.
  5. See the resultThe result shows as text, as a hex dump, as a table of its characters with their code points, names and bytes, as a preview when it is a picture, sound, video or PDF, or as an address taken apart when it is one.
  6. SwapSwap makes the result the input and turns the recipe around, so Base64 encode becomes Base64 decode: the quickest way to check that something reads back the same.
  7. Copy, download or shareCopy the result, download it as a file (a picture as a picture), or copy a link to the recipe with its input; the link carries them after the #, which browsers never send to a server.
  8. Make and read IDsUnder IDs, make UUIDs of any version (4 and 7 are the usual ones), ULIDs, NanoIDs, KSUIDs or ObjectIds, one or up to 100,000, as lines, JSON, CSV or SQL. Paste an ID under Read an ID to see what it holds and, for most kinds, when it was made.
  9. Hash text and filesUnder Hashes, type text or add files and their hashes are shown; choose the algorithms, the form (hex or Base64), and a key for an HMAC. Paste a checksum or a SHA256SUMS file to check a download. Under Passwords, make and check bcrypt, Argon2 and scrypt hashes.
  10. Make mock dataUnder Mock data, start from Users, Orders, Nested JSON or Hostile input, or paste a JSON example, a JSON Schema or a CSV header, then change the fields: their kind, options, a share left blank, uniqueness. Choose how many rows, the seed, the language and the file (JSON, CSV, SQL, XML, YAML, TypeScript), and Make: the first rows are shown, and Download has them all.
  11. Test a regular expressionUnder Regex, choose JavaScript, PCRE2 or Go, type a pattern and a text: matches are marked as you type, each pattern run by its own engine. Replace, Split and List use the matches; What it means explains and draws the pattern; tests must or must not match; and a warning comes before catastrophic backtracking. As code writes it in eight languages.
  12. Read and make a JWTUnder JWT, paste a token (with or without Bearer): its header, payload and claims are read on this device, times counting down, with warnings for alg none, a missing expiry or a well-known secret. Verify it with a secret, a PEM key or certificate, a JWK or a key set; decrypt an encrypted one; or make and sign a token of your own.
  13. Read and build a cron scheduleUnder Cron, choose the scheduler (Unix cron, GitHub Actions, Kubernetes, Jenkins, Quartz, Spring, EventBridge or systemd) and type a schedule, or build it field by field: it is said in words, its next runs are listed in any time zone with the days clocks change marked, and it can be written for another scheduler with the file that sets it up.
  14. KeysAlt or ⌥ + I goes to the input, Alt or ⌥ + A to the steps, Alt or ⌥ + S swaps, Alt or ⌥ + C copies the result, Alt or ⌥ + D downloads it, Alt or ⌥ + L copies a link, Alt or ⌥ + N starts again, Alt or ⌥ + 1 to 7 go to Encode and decode, IDs, Hashes, Mock data, Regex, JWT and Cron, and Ctrl or ⌘ + / lists the keys.

Questions people ask

Is it safe to type a password here?
It never leaves your browser and nothing is kept. Still, this is for trying settings and checking a stored hash; use a test password, and let your own server hash real ones.
What cost should bcrypt use?
OWASP suggests at least 10. Each step up doubles the time; make a hash and the page says how long it took on this device.
Can it check an Argon2 or scrypt hash?
Yes. Paste a stored $argon2id$, $argon2i$, $argon2d$ or $scrypt$ hash and the password; its settings are read from the hash itself.

This page is the Developer toolkit, opened for this one job; every other tool it has is one press away. Each of its settings is explained on the Developer toolkit's own page.

Read the step-by-step guide

Guides

Same tool, other jobs

Tools nearby