Generate secure bcrypt hashes from passwords and verify passwords against existing hashes. Processing happens server-side — never in JavaScript.
Websites should never store passwords as plain text or as a quick hash such as MD5. Bcrypt is a password hashing function that is deliberately slow, so an attacker who steals a user database cannot test billions of guesses per second. This tool creates bcrypt hashes and checks whether a password matches an existing hash, which is handy for testing login code, filling a development database, or resetting an admin password by hand.
A bcrypt hash looks like $2y$12$ followed by 53 characters. The first part is the version, the number after it is the cost, then come a 22-character random salt and the 31-character hash. Because the salt is random, hashing the same password twice gives two different results, and both verify correctly. That is expected, not a bug.
Each step up in cost doubles the work. A cost of 10 to 12 is typical today. Choose the highest value that keeps a login under about a quarter of a second on your server, and raise it as hardware gets faster. Old hashes keep working, because each one stores its own cost.