PHP Password Hash Gen

Securely generate password hashes compatible with PHP's password_hash()

PHP Tool

Algorithm

Cost Factor

Generated Hash Output

PHP Implementation

See the shape of a PHP password hash

PHP developers meet strings like $2y$10$... constantly, in user tables, seed files and tutorials. This page helps you understand that format and produces a matching password_verify() code example you can adapt. Please read the note below about what the generated value is, because it matters for how you use it.

Using the page

Type a password into the Plaintext Password field. Load Sample inserts an example password and Clear empties it.
Choose an option from the Algorithm menu: BCRYPT (Recommended), ARGON2I or DEFAULT.
Move the Cost Factor slider between 4 and 15. The number beside it updates as you drag.
Click Generate Hash.
The Generated Hash Output panel shows the string, with a Copy Hash button. Under it, a PHP Implementation block gives a password_verify() example with your password and the generated string filled in.

Important: this is a format preview

The string is created by a small demonstration routine in your browser. It begins with a bcrypt-style $2y$10$ prefix followed by random characters, and it changes every time you click. It is not produced by PHP's password_hash() function, and the algorithm menu and cost slider do not change the value. That means the output will not pass password_verify() against your real password, and it should never be stored in a database or used to protect an account.

What it is good for

Showing a student or colleague what a bcrypt-style hash looks like.
Grabbing a password_verify() snippet to adapt in your own project.
Creating placeholder values for UI mock-ups or documentation.
Testing that a form field accepts a hash-shaped string.

How to create a real hash

In your own PHP environment, call password_hash($password, PASSWORD_BCRYPT, ['cost' => 12]) or simply password_hash($password, PASSWORD_DEFAULT), store the returned string, and check logins with password_verify(). Choose a cost your server can handle in a fraction of a second, and re-hash with password_needs_rehash() when you raise it. Argon2 support depends on how PHP was compiled.

Avoid entering real passwords into any online tool. Use throwaway sample values here.

Related Tools

Frequently Asked Questions

Is the generated hash a real password_hash() result?

No. It is a demonstration string with a bcrypt-style prefix and random characters, created in your browser. It will not validate with password_verify() against your password, so do not store it or use it for real accounts.

Do the algorithm and cost settings change the output?

In the current version they do not affect the string; the controls show the options PHP offers. To see the real effect of BCRYPT, ARGON2I or a different cost, run password_hash() in your own PHP environment.

How do I generate a proper hash for my app?

Call password_hash($password, PASSWORD_DEFAULT) in PHP and store the result in your database. When a user logs in, check the entered password against the stored value with password_verify(). Never store the plaintext password.

What cost value should I choose?

Pick the highest cost that keeps hashing to a fraction of a second on your production server. Values around 10 to 12 are common for bcrypt, but test on your hardware, and raise the cost over time as servers get faster.

Should I type my real password here?

No. The output is not a genuine hash, so there is nothing to gain, and it is good practice never to type real passwords into online tools. Use an example value such as the sample provided.