Password Hash Generator (Default)
Create a secure password hash with the PHP password_hash() function using PASSWORD_DEFAULT, or generate a strong random password first and hash it in one step.
What Password Hash Generator (Default) Does
Password Hash Generator (Default) uses the built in PHP function password_hash() with the PASSWORD_DEFAULT algorithm constant. PASSWORD_DEFAULT always points to whatever algorithm the PHP team currently considers the strongest safe default, so your code keeps improving as PHP is upgraded without any change on your side. Today that default is bcrypt, and the resulting hash begins with $2y$.
Password hashing is not the same thing as encryption. Encryption is reversible, which means anyone holding the key can recover the original text. A password hash is a one way transformation: there is no function that turns a bcrypt hash back into the password that produced it. That is exactly what you want for stored login credentials, because if your database is ever exposed, the attacker is left with values that are extremely expensive to attack rather than a ready made list of user passwords.
How To Use This Tool
- Type the password you want to hash, or press the generate button to create a strong random password using a cryptographically secure random source.
- Review the detected algorithm shown with the result. PHP picks the safest current default for you.
- Press the hash button and copy the result. Store that complete string in a single database column, never the password itself.
Why bcrypt And Not MD5 Or SHA-256
MD5, SHA-1, and SHA-256 were designed to be fast. That speed is a feature for file checksums and a serious weakness for passwords, because a modern graphics card can test billions of fast hash guesses per second. bcrypt and Argon2 are deliberately slow and memory demanding, and their cost factor can be raised as hardware gets faster. A single bcrypt check that takes roughly a quarter of a second is invisible to a real user logging in, but it reduces a brute force attacker from billions of guesses per second to a handful. bcrypt also salts every hash automatically, which defeats precomputed rainbow tables and stops two users with the same password from having the same stored value.
Correct Use In A PHP Project
When a user registers, run their password through password_hash() and save the returned string in a database column of at least 255 characters. Never trim, lowercase, or otherwise modify the hash, and never apply your own extra hashing on top of it. When the user logs in, load the stored hash and call password_verify() with the submitted password. Do not compare hashes with == or with a fresh call to password_hash(), because a new salt is generated each time and the two strings will never be equal. After a successful login you can call password_needs_rehash() to detect an outdated cost factor and quietly upgrade the stored hash while you still have the plain password in memory.
Privacy And Safety Notes
KST Tool Web does not store, log, cache, or share any password or hash submitted to this tool. The value is processed by PHP in a single request and then discarded, and the response headers explicitly disable caching. Even so, the safest habit is to treat any online tool as a learning and testing aid rather than a place to handle live production credentials. Use it to understand the output format, to check that your verification logic behaves as expected, or to generate a strong password for a new account. For real user accounts, run password_hash() directly inside your own application, always serve the login form over HTTPS, and add rate limiting so that repeated failed attempts are slowed down.
Frequently Asked Questions
Why is the hash different every time I press the button?
A fresh random salt is generated for every call. Different hashes for the same password is correct behaviour, and password_verify() still matches all of them.
Can I get the original password back from a hash?
No. The transformation is one way by design. Anyone offering a bcrypt decrypter is either running a dictionary attack or simply not telling the truth.
How long should my database column be?
Current bcrypt hashes are sixty characters, but the PHP manual recommends 255 characters so future algorithms and longer Argon2 output still fit without truncation.
Does password length matter with bcrypt?
Yes. bcrypt only reads the first 72 bytes of the input, so anything beyond that is ignored. This is rarely a problem for real passwords, but it matters if you pre hash long inputs before calling bcrypt.