Skip to content
bcryptdog

Bcrypt hashes Python will accept

Set to the $2b$ prefix and cost 12 that Python expects. Change either one if your project has been configured differently. Nothing you type here leaves the browser.

Everything here runs locally

0/72 bytes 4,096 iterations 0 network requests

PHP counts only $2y$ as bcrypt, so Laravel Hash::check() rejects this hash with "This password does not use the Bcrypt algorithm" before it compares anything. Pick $2y$ for PHP, Laravel or Symfony. Why the prefix matters

The bcrypt package writes $2b$ and takes bytes rather than a string, so encode first. Its gensalt default is 12 rounds as of version 4. From version 5.0 onward hashpw raises a ValueError on a password longer than 72 bytes; earlier versions truncated it silently.

The same thing in Python

Hashing in Python

import bcrypt

hash = bcrypt.hashpw(b'correct horse battery staple', bcrypt.gensalt(12))

Checking a password

if bcrypt.checkpw(password.encode(), stored_hash):
    ...  # the password matched

From a terminal

python -c "import bcrypt; print(bcrypt.hashpw(b'correct horse battery staple', bcrypt.gensalt(12)).decode())"

Check a hash from your database

Paste a stored hash and a candidate password to confirm they match, which is a quick way to rule the hash out when a login is failing for reasons you cannot see.

Verification also runs locally

Other stacks

Questions people ask

Which prefix does Python write?
$2b$. The tool on this page is set to that by default. For any password under 72 bytes the digest is identical across $2a, $2b and $2y, so the prefix is a label rather than a different algorithm, and most libraries verify all three regardless of which one they produce. PHP is the exception: password_verify accepts all three, but password_get_info reports bcrypt only for $2y, and Laravel Hash::check asks that question before it compares, so a $2a or $2b hash is refused there with "This password does not use the Bcrypt algorithm".
What cost does Python use by default?
The bcrypt package writes $2b$ and takes bytes rather than a string, so encode first. Its gensalt default is 12 rounds as of version 4. From version 5.0 onward hashpw raises a ValueError on a password longer than 72 bytes; earlier versions truncated it silently.
Can I paste this hash straight into my database?
Yes. A bcrypt hash is 60 characters and carries its own version, cost and salt, so the column needs no companion fields. Check the column is at least 60 characters wide, because a narrower one will truncate and lock the account out.
Is it safe to generate a production password here?
The hashing runs in your browser and this page makes no network request when you press the button. For a seed account or a test fixture that is fine. For a real user credential, the better habit is to let your own application hash it.
Why does my Python login reject a hash that looks correct?
Usually one of four things: a prefix the framework will not accept, which on PHP and Laravel means anything other than $2y$, a trailing newline picked up during copy and paste, a column too narrow to hold all 60 characters, or a password longer than 72 bytes where the two sides truncated it differently.

Next