Bcrypt hashes Node.js will accept
Set to the $2b$ prefix and cost 12 that Node.js expects. Change either one if your project has been configured differently. Nothing you type here leaves the browser.
Everything below this line runs locally
0/72 bytes · 4,096 iterations · 0 network requests
PHP counts only $2y$ as bcrypt, so Laravel Hash::check() rejects this hash with "This password does not use the Bcrypt algorithm" before it compares anything. Pick $2y$ for PHP, Laravel or Symfony. Why the prefix matters
Both the native bcrypt package and the pure JavaScript bcryptjs write the $2b$ prefix. Use the async calls in a server, since the sync ones block the event loop for the entire cost of the hash.
The same thing in Node.js
Hashing in Node.js
import bcrypt from 'bcryptjs';
const hash = await bcrypt.hash('correct horse battery staple', 12);Checking a password
const ok = await bcrypt.compare(req.body.password, user.passwordHash);From a terminal
node -e "import('bcryptjs').then(b => b.hash('correct horse battery staple', 12).then(console.log))"Check a hash from your database
Paste a stored hash and a candidate password to confirm they match, which is a quick way to rule the hash out when a login is failing for reasons you cannot see.
Verification also runs locally
Other stacks
- Laravel Bcrypt hashes with the $2y$ prefix and Laravel defaults.
- PHP Hashes that PHP password_verify accepts, with the $2y$ prefix.
- Python Hashes for the Python bcrypt package and passlib, $2b$ prefix.
- Java Hashes for jBCrypt and Spring Security, $2a$ prefix.
- Spring Security Hashes for BCryptPasswordEncoder, $2a$ prefix at strength 10.
- Go Hashes for golang.org/x/crypto/bcrypt, $2a$ prefix.
Questions people ask
- Which prefix does Node.js write?
- $2b$. The tool on this page is set to that by default. For any password under 72 bytes the digest is identical across $2a, $2b and $2y, so the prefix is a label rather than a different algorithm, and most libraries verify all three regardless of which one they produce. PHP is the exception: password_verify accepts all three, but password_get_info reports bcrypt only for $2y, and Laravel Hash::check asks that question before it compares, so a $2a or $2b hash is refused there with "This password does not use the Bcrypt algorithm".
- What cost does Node.js use by default?
- Both the native bcrypt package and the pure JavaScript bcryptjs write the $2b$ prefix. Use the async calls in a server, since the sync ones block the event loop for the entire cost of the hash.
- Can I paste this hash straight into my database?
- Yes. A bcrypt hash is 60 characters and carries its own version, cost and salt, so the column needs no companion fields. Check the column is at least 60 characters wide, because a narrower one will truncate and lock the account out.
- Is it safe to generate a production password here?
- The hashing runs in your browser and this page makes no network request when you press the button. For a seed account or a test fixture that is fine. For a real user credential, the better habit is to let your own application hash it.
- Why does my Node.js login reject a hash that looks correct?
- Usually one of four things: a prefix the framework will not accept, which on PHP and Laravel means anything other than $2y$, a trailing newline picked up during copy and paste, a column too narrow to hold all 60 characters, or a password longer than 72 bytes where the two sides truncated it differently.