crypto_bcrypt
Hash a plaintext password using bcrypt with a configurable cost factor. Generates a fresh salt each call, returning the hash string, cost, salt, and strength analysis.
Instructions
Bcrypt Password Hasher. Hash a plaintext password with bcrypt at a chosen cost factor, generating a fresh random salt on every call. Use this to create a new stored password hash; use crypto_bcrypt_verify instead to check a password against an existing hash, and crypto_argon2 / crypto_scrypt / crypto_pbkdf2 for the other adaptive/memory-hard password KDFs. Runs locally with PHP password_hash on the input you provide: read-only, non-destructive, contacts no external service, and is rate-limited (5 requests/minute for anonymous callers). Because a new salt is drawn each call, the same password yields a different hash each time. Returns the bcrypt hash string plus the cost, salt, parsed format breakdown, and a strength analysis of the chosen cost factor.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| password | Yes | The plaintext password to hash. Must be non-empty. | |
| cost | No | Bcrypt cost factor (log2 of the key-expansion rounds); higher is slower and more brute-force resistant. 12 is recommended for production. Values outside 4-15 are rejected with a 400. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| password | No | The plaintext password that was hashed (echoed back from the request). | |
| hash | No | The bcrypt hash in modular crypt format $2y$<cost>$<22charSalt><31charDigest>. | |
| cost | No | The cost factor used to generate the hash. | |
| algorithm | No | Always "bcrypt". | |
| salt | No | The 22-character base64 salt parsed from the generated hash. | |
| duration | No | Time taken to generate the hash, in seconds (rounded to 3 decimals). | |
| info | No | Fields parsed from the generated bcrypt hash. | |
| format | No | Structural breakdown of the hash string. | |
| security | No | Strength analysis of the chosen cost factor. | |
| error | No | Present only on a 4xx/5xx error response (e.g. missing password or cost out of range); absent on success. |