TASK
Hash a password and verify it later without storing the plaintext
Use a slow password-hashing function (bcrypt/PBKDF2/scrypt) to store a salted hash, then verify a candidate password against it.
- 1
Never store passwords in plaintext or with fast hashes (MD5/SHA-256) — they are trivially brute-forced. Use a slow, salted KDF (bcrypt, scrypt, PBKDF2) that deliberately costs CPU/memory per attempt, making bulk cracking infeasible.
- 2 bcrypt Hash →
Enter the password and a cost factor (10-12 for interactive, 12-14 for sensitive). The tool outputs a self-describing hash containing the algorithm, cost, salt, and digest.
- 3 Hash Compare →
To verify: enter the candidate password and the stored bcrypt hash. The tool re-hashes with the embedded salt and cost and compares in constant time — returns true/false without revealing timing information.
- 4 hash → crc32
Use the hash-and-verify chain to test the full lifecycle: hash a password, then verify a correct and an incorrect candidate in one pass.
Frequently asked questions
- Why can't I use SHA-256 for password hashing?
- SHA-256 is fast — a GPU can compute billions per second. bcrypt/scrypt are deliberately slow and memory-hard, making each guess cost milliseconds. This asymmetry is what protects slow hashes against offline brute force.
- What cost factor should I choose?
- Choose the highest cost that still meets your latency budget. For bcrypt, cost 10 takes ~100ms, cost 12 ~400ms, cost 14 ~1.6s. Increase the cost as hardware speeds up — the hash embeds the cost so old hashes still verify.
Workflows that solve this
BLAKE Hash with CRC32 Checksum
Compute BLAKE hash then CRC32 checksum for integrity verification. PIPELINE
Hash content and encode as Base64
Compute a hash of the input and encode the hash digest as Base64 for compact transport. PIPELINE
Hash text and verify integrity
Compute a hash of the input text and compare it against an expected hash to verify integrity. PIPELINE
Hash text and verify with CRC32 checksum
Compute both a cryptographic SHA-256 hash and a CRC32 checksum for data integrity verification. PIPELINE
Format JSON and compute integrity checksum
Pretty-print a JSON document and compute a CRC32 checksum to detect any subsequent modifications. PIPELINE
MD5 Hash then Base58 Encode
Compute MD5 hash then encode as Base58 for compact representation. PIPELINE
Multi-hash speed comparison
Hash the input and benchmark multiple hash algorithms to compare their speed and output. PIPELINE
Generate Password and Bcrypt Hash
Generate a random password then bcrypt-hash for auth systems. PIPELINE
Generate password and hash with bcrypt
Generate a strong random password and immediately hash it with bcrypt for safe storage. PIPELINE
Generate Password and Hash
Generate a random password then hash it for secure storage. PIPELINE
SHA3-256 Hash with CRC32 Checksum
Compute SHA3-256 hash then CRC32 checksum for dual integrity verification. PIPELINE
SHA-512 Hash then Hex Encode
Compute SHA-512 hash then encode as hex for readability. PIPELINE
Reverse Text and Hash
Reverse text then compute SHA-256 hash of the reversed result. PIPELINE
Scramble Text and Hash
Scramble text then hash the scrambled result. PIPELINE
Learn more
Want to understand why?
Choosing a hash algorithm: digests, password hashing, and MACs are three different jobs
A field guide to SHA-2, SHA-3, BLAKE2, MD5, bcrypt/Argon2, and HMAC — which one fits integrity checks, password storage, and message authentication, and why they are not interchangeable. TUTORIAL
How to Derive Keys with PBKDF2
Derive a cryptographic key from a password using PBKDF2 with a high iteration count and salt. TUTORIAL
Argon2
Argon2 is the password hashing function that won the Password Hashing Competition; it fills and traverses a memory matrix over multiple passes, providing strong memory hardness and time-memory trade-off resistance. GLOSSARY
Argon2d
Argon2d is the data-dependent addressing variant of Argon2: memory access indices depend on the previous block's output, giving the strongest time-memory trade-off resistance. GLOSSARY
Related tools
bcrypt Hash
Hash passwords with bcrypt or verify bcrypt hashes. Free, private, and 100% client-side. TOOL
PBKDF2 Key Derivation
Derive a key from a password using PBKDF2 (RFC 2898) with Web Crypto API. Free, private, and 100% client-side. TOOL
scrypt Key Derivation
Derive a key from a password using scrypt (memory-hard KDF). Free, private, and 100% client-side. TOOL
Hash Compare
Compare MD5, SHA-1, SHA-256, SHA-384, SHA-512 of the same input. Free, private, 100% client-side. TOOL