General dev

Bcrypt-Style Hash Demo (Not Bcrypt)

Runs locally

Use Bcrypt-Style Hash Demo (Not Bcrypt)

What it does

A demonstration that imitates the look of a bcrypt hash using a random salt and a single SHA-256 digest. It is not real bcrypt, and bcrypt libraries cannot check its output.

It runs entirely in your browser: nothing you enter is uploaded.

Example

Demo password

Input
correct horse battery staple
Output (captured 2026-10-20)
$2b104N0esUZY6nJ57l9mUBelJ9ql0Aox0rzBIbN.hVW1ijwX8BALiTaqk

A string that starts with $2b10 followed by 53 characters of encoded salt and digest; it changes on every run because the salt is random.

FAQ

Is this real bcrypt?

No. It puts a random 16-byte salt in front of the password, hashes that once with SHA-256 and prints the first 53 Base64 characters of salt and digest after $2b and the rounds number. Real bcrypt runs the Eksblowfish key setup 2^cost times; here the rounds setting does not change the computation.

Can it verify a bcrypt hash?

No. Verify mode rejects the strings that Hash mode produces as an invalid format, and it cannot check hashes made by real bcrypt libraries. To create or check real bcrypt hashes, use a maintained library such as bcrypt for Node.js or Python, or htpasswd -B.

Is my password sent anywhere?

No. Everything runs in your browser with the Web Crypto API and nothing is uploaded. Even so, do not type a password you actually use.