Free online tools that run in your browser
Your files never leave your device · No login required · 100% free
Convert, compress, calculate, generate, edit and check files right in your browser — fast, private and easy to use.
Search results
Popular tools
View all toolsBrowse by category
Popular file conversions
View all convertersProgramming
Learn and practise programming in your browser. Pick a language: write code, run it in a real terminal and follow the lessons step by step.
Why Shiklo Tools?
Simple, private tools that just work — right in your browser.
- Private Everything runs in your browser. Files are never uploaded.
- Secure Encrypted HTTPS connection, and nothing you open is stored on our servers.
- No login required No account, no sign-up, no email. Just open a tool and use it.
- Fast No upload or download wait — results appear instantly.
- Free All tools are free to use, with no limits.
- Works everywhere Phone, tablet or computer, in any modern browser.
🆕 New tools
★ Popular tools
Recently used
Frequently asked questions
Are my files or text uploaded anywhere?
No. Every tool runs inside your browser on your own device. Nothing you enter or open is sent to a server.
Do I need to create an account or log in?
No login is required. There are no accounts — open any tool and start using it straight away.
Are the tools really free?
Yes. All tools are free, with no limits or watermarks. The site is supported by ads.
Does it work on my phone?
Yes. The tools work in any modern browser on phones, tablets and computers.
Can I use the tools offline?
Once a tool has loaded it does its work on your device, so it keeps working even if your connection drops.
Which file types are supported?
PDF, Word, Excel, PowerPoint, OpenDocument and RTF documents, JPG, PNG, WebP, HEIC, AVIF, GIF and BMP images, MP4, MOV, WebM and MKV videos, MP3, WAV, M4A, OGG and FLAC audio, ZIP, 7z, RAR, TAR and GZIP archives, CSV, JSON, XML and plain text. Each tool lists exactly what it opens.
All tools with descriptions →
Bcrypt Generator
Hash a password with bcrypt at the cost you choose, or check a password against an existing $2a$, $2b$ or $2y$ bcrypt hash.
Bcrypt is one of the most widely used ways to store passwords safely. Instead of keeping the password, a site stores a bcrypt hash: a one-way fingerprint that includes a random salt and a cost factor which makes every guess slow for attackers. Frameworks such as Laravel, Django (as an option), Spring Security, Ruby on Rails and many others use it, and you often need a bcrypt hash by hand — to seed an admin account, write a test fixture or reset a password directly in a database.
This tool hashes a password with bcrypt at the cost you choose and shows how long it took, or checks whether a password matches an existing hash in the $2a$, $2b$ or $2y$ format. It uses hash-wasm, a fast WebAssembly implementation, inside your browser: the password is never stored, logged or sent anywhere.
How to use Bcrypt Generator
- Choose Create a hash or Check a password.
- Type the password.
- To hash: choose the cost and press Hash password. To check: paste the hash and press Check password.
- Copy the hash, or read whether the password matches.
Features
- Bcrypt hashes with cost 4 to 15 (12 by default).
- Random 16-byte salt for every hash.
- Checks passwords against $2a$, $2b$ and $2y$ hashes.
- Shows the cost and how long hashing took.
- Warns when a password is longer than bcrypt's 72-byte limit.
- WebAssembly (hash-wasm) in your browser; nothing is sent.
Reading a bcrypt hash
A bcrypt hash is 60 characters long and contains everything needed to check a password later. The parts are separated by dollar signs.
| Part | Example | Meaning |
|---|---|---|
| Version | 2b | Bcrypt variant ($2a$, $2b$ and $2y$ are compatible) |
| Cost | 12 | 2 to the power of 12 = 4,096 rounds of the key setup |
| Salt | first 22 characters | Random salt, different for every hash |
| Hash | last 31 characters | The result for this password and salt |
Choosing the cost
Each step up in cost doubles the work, both for your server when a user logs in and for an attacker trying passwords. A common guideline is to choose the highest cost that keeps hashing around a quarter of a second on your server; today that is usually 12, which is also this tool's default. The time shown here is measured in your browser and only a rough guide to your server's speed. Cost 4 is useful only for quick tests, never for real passwords.
The 72-byte limit
Bcrypt only uses the first 72 bytes of a password; anything after that is ignored, so two long passwords that share the first 72 bytes produce matching hashes. Accented letters and other non-ASCII characters take two to four bytes each, so the limit can be reached sooner than you think. The tool warns you when a password is too long. For new systems, Argon2id avoids this limit and resists attacks with graphics cards better — use the Argon2 Hash Generator.
Why the hash changes every time
Each hash gets a new random salt, so hashing the same password twice gives two different hashes — and both are correct. That is what stops attackers from using precomputed tables of common passwords. To check a password, the salt and cost are read from the stored hash and the password is hashed again in the same way, which is exactly what Check a password does. $2y$ hashes from PHP are checked as the equivalent $2b$ format.
Use it safely
Because hashing runs on your device, the password never leaves your browser. Even so, avoid typing real production passwords into any website unless you trust it; for live systems, generate hashes with your framework's own tools. To create strong passwords first, use the Password Generator, and to see how hard a password is to crack, use the Password Strength Checker.
Frequently asked questions
How do I generate a bcrypt hash?
Type the password, choose the cost and press Hash password.
How do I check a password against a bcrypt hash?
Choose Check a password, type the password, paste the hash and press Check password.
What cost should I use?
12 is a sensible default today; higher if your server can afford it.
Why is the hash different each time?
A new random salt is used for every hash. All of them verify correctly.
Are $2y$ hashes from PHP supported?
Yes. They are checked as the equivalent $2b$ format.
Is my password sent anywhere?
No. Hashing runs in your browser with WebAssembly.
Should I use bcrypt or Argon2?
Both are good; Argon2id is the modern recommendation for new systems.
Related tools
Argon2 Hash GeneratorHash passwords with Argon2id, Argon2i or Argon2d — memory, iterations and parallelism adjustable — and verify encoded $argon2 hashes.
PBKDF2 GeneratorDerive a key from a password with PBKDF2 (HMAC-SHA-256, SHA-512 and more) — salt, iterations and length adjustable, hex or Base64 output.
Hash GeneratorGenerate MD5, SHA-1, SHA-256, SHA-512, SHA-3, BLAKE3 and CRC32 hashes of text or files of any size, with HMAC and checksum comparison. Private.
Password GeneratorGenerate strong random passwords and memorable passphrases. Choose length and characters; see entropy and crack time. Never stored or sent.
Password Strength CheckerCheck how strong a password really is: common passwords, words, names, keyboard patterns and dates detected, crack-time estimates and tips.
Random Bytes GeneratorGenerate cryptographically secure random bytes for keys, salts, nonces and tokens — as hex, Base64, Base64url, byte arrays or a file.