Before building our bcrypt hash generator, we checked two tools directly and looked into a specific, well-documented bcrypt limitation.
Your actual password, sent to a server
We checked devglan.com's bcrypt tool directly, and its own page states: "This tool processes all hashing server-side." That means a real password — the same kind you'd use for an actual account — gets transmitted over the network, even with a no-storage policy attached. This tool hashes and verifies entirely in your browser via the bcryptjs library; nothing is ever sent anywhere.
The 72-byte limit nobody mentions
bcrypt has a well-documented quirk: it's built on Blowfish's 72-byte key schedule, so anything past the 72nd byte is silently dropped — not truncated with a warning, just ignored. For multi-byte scripts this bites even harder, since the cutoff lands on bytes, not characters, and a long password can end up no more secure than its first 30-something characters. We checked the generators we could find, and none of them flag this. Ours counts your password's actual UTF-8 byte length and shows a warning the moment you cross 72.
Live hashing and instant verification, one page
Beyond the security details: the hash updates as you type (a competing tool needs a "Generate Hash" click), and a separate Verify tab lets you check a candidate password against an existing bcrypt hash without leaving the page.
