Skip to content
bcryptdog

Bcrypt hashes Node.js will accept

Set to the $2b$ prefix and cost 12 that Node.js expects. Change either one if your project has been configured differently. Nothing you type here leaves the browser.

Everything here runs locally

0/72 bytes 4,096 iterations 0 network requests

PHP counts only $2y$ as bcrypt, so Laravel Hash::check() rejects this hash with "This password does not use the Bcrypt algorithm" before it compares anything. Pick $2y$ for PHP, Laravel or Symfony. Why the prefix matters

Both the native bcrypt package and the pure JavaScript bcryptjs write the $2b$ prefix. Use the async calls in a server, since the sync ones block the event loop for the entire cost of the hash.

The same thing in Node.js

Hashing in Node.js

import bcrypt from 'bcryptjs';

const hash = await bcrypt.hash('correct horse battery staple', 12);

Checking a password

const ok = await bcrypt.compare(req.body.password, user.passwordHash);

From a terminal

node -e "import('bcryptjs').then(b => b.hash('correct horse battery staple', 12).then(console.log))"

Check a hash from your database

Paste a stored hash and a candidate password to confirm they match, which is a quick way to rule the hash out when a login is failing for reasons you cannot see.

Verification also runs locally

Other stacks

Questions people ask

Which prefix does Node.js write?
$2b$. The tool on this page is set to that by default. For any password under 72 bytes the digest is identical across $2a, $2b and $2y, so the prefix is a label rather than a different algorithm, and most libraries verify all three regardless of which one they produce. PHP is the exception: password_verify accepts all three, but password_get_info reports bcrypt only for $2y, and Laravel Hash::check asks that question before it compares, so a $2a or $2b hash is refused there with "This password does not use the Bcrypt algorithm".
What cost does Node.js use by default?
Both the native bcrypt package and the pure JavaScript bcryptjs write the $2b$ prefix. Use the async calls in a server, since the sync ones block the event loop for the entire cost of the hash.
Can I paste this hash straight into my database?
Yes. A bcrypt hash is 60 characters and carries its own version, cost and salt, so the column needs no companion fields. Check the column is at least 60 characters wide, because a narrower one will truncate and lock the account out.
Is it safe to generate a production password here?
The hashing runs in your browser and this page makes no network request when you press the button. For a seed account or a test fixture that is fine. For a real user credential, the better habit is to let your own application hash it.
Why does my Node.js login reject a hash that looks correct?
Usually one of four things: a prefix the framework will not accept, which on PHP and Laravel means anything other than $2y$, a trailing newline picked up during copy and paste, a column too narrow to hold all 60 characters, or a password longer than 72 bytes where the two sides truncated it differently.

Next