Password hasher online: bcrypt, Argon2, and PBKDF2 in your browser

Hash any password using bcrypt, Argon2, PBKDF2, or SHA-256 instantly with the password hasher at ToolHQ. Your password is hashed entirely in your browser and never sent to any server. Use it to generate test hashes, verify your hashing library output, or understand how password storage works.

A password hasher converts a plain-text password into a fixed-length hash string using a one-way cryptographic function. Unlike encryption, hashing cannot be reversed: the original password cannot be recovered from the hash. This is exactly what makes hashing the correct way to store passwords in a database. If your database is compromised, attackers get hashes they cannot directly use, not the original passwords.

Key Takeaways

• Password hashing is one-way: the original password cannot be recovered from a hash
• Never store plain-text passwords: always store the hash and compare at login
• bcrypt, Argon2, and PBKDF2 are designed for passwords: they are intentionally slow and include salting
• SHA-256 is a fast hash and should not be used alone for password storage
• Your password is hashed entirely in your browser, nothing is sent to any server

Why passwords must be hashed, not stored

Storing plain-text passwords in a database is one of the most serious security failures a developer can make. If the database is compromised by a breach, SQL injection, or misconfigured access controls, every user's password is immediately exposed. Attackers can then try those passwords against every other service where your users might have reused them.

Hashing solves this. When a user sets a password, the application:

1. Hashes the password using an algorithm like bcrypt or Argon2
2. Stores only the hash in the database
3. Never stores the original password

When the user logs in:

1. The application hashes the submitted password using the same algorithm and parameters
2. Compares the resulting hash to the stored hash
3. If they match, the password is correct; if not, it is wrong

The original password is never stored anywhere. If the database is compromised, attackers get hashes they would need to crack, which is computationally expensive if a slow algorithm was used.

Mini-story: A developer was building user authentication for a new web application. Before writing a single line of code, she reviewed the OWASP Password Storage Cheat Sheet to choose the right algorithm. She chose Argon2id with recommended parameters and used ToolHQ's password hasher to generate test hashes for her unit tests, verifying that her implementation produced identical outputs to the reference implementation.

Password hashing algorithms compared

Not all hashing algorithms are equally suited to passwords. The key difference is speed: cryptographic hash functions like SHA-256 are designed to be fast. For file hashing and data integrity, speed is a virtue. For passwords, speed is a vulnerability: a fast hash means an attacker with powerful hardware can try billions of password guesses per second.

Password hashing algorithms are intentionally slow:

Argon2 won the Password Hashing Competition in 2015 and is now the recommended choice for new applications. It is memory-hard, meaning it requires significant RAM to compute. This limits how many guesses an attacker can run in parallel, even with GPU or ASIC hardware.

bcrypt has been the industry standard since 1999. It uses a configurable work factor (also called cost factor or rounds) that controls how long the hash takes to compute. Increasing the work factor by 1 doubles the computation time, allowing you to keep pace with hardware improvements over time.

PBKDF2 (Password-Based Key Derivation Function 2) applies a pseudorandom function (typically HMAC-SHA256) a configurable number of times. NIST recommends PBKDF2 and it is often required in environments subject to FIPS compliance.

What salting is and why it matters

A salt is a random value added to the password before hashing. Bcrypt, Argon2, and PBKDF2 all generate a unique salt automatically for each password.

Salting prevents two attacks:

Rainbow table attacks: A rainbow table is a precomputed database mapping common passwords to their hashes. Without salting, an attacker who gets your database can look up hashes in their table and immediately know the passwords for common values. With salting, even "password123" produces a different hash every time it is hashed, making precomputed tables useless.

Batch cracking: Without salting, if two users have the same password, they have the same hash. An attacker who cracks one hash cracks both. With salting, every hash is unique even for identical passwords, so each must be cracked individually.

bcrypt and Argon2 include the salt in the hash output, so you only need to store a single string per user. The algorithm extracts the salt from the stored hash when it is time to verify a login.

Mini-story: A security consultant was auditing a legacy PHP application built in 2009. She found the application was storing passwords as unsalted MD5 hashes. She pulled up the database export the client had provided, pasted a few hashes into an online MD5 lookup, and instantly found the plain-text passwords for several accounts including the admin. She presented the finding to the client and recommended migrating to bcrypt with a cost factor of 12, with a migration strategy that rehashed passwords on next login.

How to use the password hasher step by step

1. Open the tool. Visit ToolHQ's password hasher.
2. Enter the password to hash. Type or paste the password string. It is processed entirely in your browser.
3. Choose the algorithm. Select bcrypt, Argon2id, PBKDF2, or SHA-256 based on your use case.
4. Adjust parameters. For bcrypt, set the cost factor (10-12 is recommended for most applications). For Argon2 and PBKDF2, set iteration count or memory parameters.
5. Generate the hash. Click "Hash". The tool produces the hash string, including the embedded salt for bcrypt and Argon2.
6. Use the output. Copy the hash for use in test data, unit tests, or to verify your application's output matches a reference hash.

Frequently asked questions

Can I use this tool to crack a password hash? No. Hashing is one-way: you cannot reverse a hash to get the password. ToolHQ's password hasher generates hashes from input passwords. It does not attempt to reverse or crack existing hashes.

What cost factor should I use for bcrypt? OWASP recommends a cost factor that takes at least 1 second to compute on your hardware, typically cost factor 10 to 12 on modern servers. Higher is more secure but increases login response time. Benchmark on your target hardware and choose the highest value that keeps login under your response time requirement.

How is this different from the ToolHQ hash generator? The hash generator produces fast cryptographic hashes (MD5, SHA-1, SHA-256, SHA-512) for file integrity and general data hashing. The password hasher uses slow, salted algorithms specifically designed for securely storing passwords. Use the hash generator for file verification and the password hasher for password storage.

What is the difference between password hashing and encryption? Encryption is two-way: you can decrypt ciphertext back to plaintext with the correct key. Hashing is one-way: you cannot recover the original input from the hash. For password storage, hashing is correct because you never need to see the original password again. For storing data you need to read back (like API keys), use encryption.

Does a longer password produce a longer hash? No. Hash outputs are always the same fixed length regardless of input length. A bcrypt hash is always 60 characters. A SHA-256 hash is always 64 hexadecimal characters. This fixed length is a defining property of hash functions.

The short version

Password hashing is the correct way to store user credentials. Unlike plain-text storage or reversible encryption, hashing means a compromised database does not expose usable passwords. bcrypt, Argon2id, and PBKDF2 are designed for passwords: they are intentionally slow, include automatic salting, and have configurable work factors you can increase as hardware improves. SHA-256 and MD5 are too fast for password storage and should not be used alone. ToolHQ's password hasher runs these algorithms entirely in your browser, so your test passwords are never transmitted anywhere.

Hash a password now at ToolHQ.

Related tools: Password generator | Hash generator | Encryption tool | Data breach checker