About this tool
Passwords are never stored in plain text but as a hash. Fast checksums like SHA-256 are the wrong tool for that: password hashes have to be deliberately slow and include a random salt, so that attackers cannot try billions of passwords per second after a data breach.
The password hash generator creates hashes with bcrypt, Argon2id, Argon2i, Argon2d, scrypt and PBKDF2 with SHA-256 or SHA-512. The parameters (cost factor, memory, iterations, parallelism) default to the recommendations of the OWASP Password Storage Cheat Sheet and can be adjusted.
In “Verify” mode you paste an existing hash: the tool detects algorithm and parameters and checks whether a password matches. It understands bcrypt ($2a$, $2b$, $2y$ from PHP), Argon2 in PHC format, scrypt in PHC/passlib format and PBKDF2 in PHC, passlib and Django format.
Everything runs locally in your browser. Password and hash are neither uploaded nor stored in the URL.
How it works
- Choose “Hash” and enter the password.
- Pick the algorithm and adjust the parameters if needed – “Defaults” resets them to the recommendation.
- Click “Generate hash” and copy the hash.
- To verify, switch to “Verify”, paste the hash, enter the password and click “Verify”.
Frequently asked questions
Which algorithm should I use?
For new applications OWASP recommends Argon2id (e.g. 19 MiB of memory, 2 passes). bcrypt is widespread and still solid, so is scrypt. PBKDF2 is mainly used where a FIPS-certified scheme is required – then with a very high iteration count (600,000 for SHA-256).
Why does the same password give a different hash every time?
Each hash gets a new random salt, which is stored inside the hash string. That way two users with the same password have different hashes, and precomputed tables do not help attackers. When verifying, the tool reads salt and parameters from the hash.
Why is bcrypt limited to 72 bytes?
bcrypt only processes the first 72 bytes of a password and ignores the rest. Accented letters and emojis take several bytes in UTF-8. The tool warns you when your password is longer. Argon2 and scrypt have no such limit.
How do I choose the cost factor or memory?
As high as your server can handle: a login should take roughly 100 to 500 ms. The tool shows the duration after each hash – in the browser it is usually a bit slower than with a native library. Every +1 on the bcrypt cost factor doubles the time.
Can I verify hashes from PHP, Django or Node.js here?
Yes. PHP’s password_hash() produces bcrypt ($2y$) or Argon2 in PHC format, and Node libraries like bcrypt and argon2 do the same. Django stores pbkdf2_sha256$…, Python passlib $pbkdf2-sha256$… and $scrypt$…. The tool detects all of these formats automatically.
Is a password hash the same as the hash generator?
No. The Hash Generator calculates fast checksums such as SHA-256 for files and text – unsuitable for passwords. Create a good password with the Password Generator and check its strength with the Password Strength Checker.