Bcrypt Hash Generator & Laravel APP_KEY

Locked out of your own admin panel? Make a $2y$ hash here and put it in the users table. Hashes made here pass PHP's password_verify(); we checked that against PHP itself.

FreeNo sign-upRuns in your browser: your data is not uploaded

Reset a Laravel or PHP admin password with SQL

  1. Type the new password above and press Generate hash.
  2. Open phpMyAdmin (or any MySQL client), select the database and run the UPDATE line shown under the hash, with your real e-mail address.
  3. Log in with the new password. Laravel's Hash::check() reads the cost from the hash itself, so cost 10 or 12 both work.

With SSH you can do the same without this page: php artisan tinker then User::where('email','you@example.com')->update(['password' => Hash::make('new-password')]);. This page is for when you only have phpMyAdmin.

$2y$, $2a$, $2b$: what is the difference?

All three are bcrypt. PHP writes $2y$; Node.js and many other libraries write $2a$ or $2b$. For normal passwords the result is the same. This tool converts the prefix to $2y$ so PHP and Laravel accept it without surprises, and it can check hashes with any of the three prefixes.

Which cost should I use?

Each step up doubles the work. Cost 10 takes roughly 50 to 100 ms on a normal server; 12 takes four times that. Laravel 11 moved its default to 12. Higher is safer against stolen databases but slows every login, so pick the highest your server handles in about a quarter of a second.

About APP_KEY

APP_KEY encrypts cookies, sessions and anything you store with Crypt::encrypt(). It is not used for password hashes, so changing it does not lock users out, but it does log everybody out and makes previously encrypted values unreadable. Generate one for a fresh install or a leaked key; do not rotate it casually on a live site that stores encrypted data.

The error "No application encryption key has been specified" means the .env line is missing or the config cache is old. Add the line, then run php artisan config:clear (or delete bootstrap/cache/config.php if you have no SSH).

FAQ

Is it safe to type a real password here?
Hashing happens in your browser with the bcrypt.js library loaded from this site; the password is not sent anywhere. For a production admin account, change the password again from inside your app afterwards, as a habit.
Why is the hash different every time?
Bcrypt adds a random salt to each hash and stores it inside the hash string. Different hashes for the same password are normal, and all of them verify.
Can I decrypt a bcrypt hash?
No. Bcrypt is one-way. You can only check whether a given password matches, which is what part 2 of this page does.
Does Laravel accept a hash made with cost 10 if my config says 12?
Yes. The cost is stored in the hash ($2y$10$). Laravel may rehash it with the new cost on the next successful login if rehashing is enabled.
Does this work for WordPress passwords?
WordPress 6.8 and newer use bcrypt with a $wp prefix, older versions use phpass ($P$). For WordPress, reset the password from the dashboard or with WP-CLI instead.

Related guides

Found it useful? Put a link in your docs, README or forum answer so others can use it too:

HTML
<a href="https://headsntail.com/tools/bcrypt-generator">Bcrypt Hash Generator & Laravel APP_KEY</a> (free, by HeadsNTail)
Markdown (GitHub, Stack Overflow, dev.to)
[Bcrypt Hash Generator & Laravel APP_KEY](https://headsntail.com/tools/bcrypt-generator)

Need it done on your server? HeadsNTail sets up Laravel apps, cPanel hosting and migrations for businesses. See services or ask a question.

More free tools

SQL to Laravel Migration ConverterPaste CREATE TABLE, get a ready Laravel migration file with foreign keys, indexes and timestamps. PHP Unserialize Viewer & Serialized String FixerRead serialized PHP data as a tree, JSON or PHP array, and repair broken string lengths after a domain change. .htaccess Generator for cPanelForce HTTPS, remove www, 301 redirects, Laravel public folder, caching and security headers. Tested rules. Cron Job Generator for cPanel & LaravelBuild or explain a cron expression, see the next run times, and copy the exact cPanel line for the Laravel scheduler or a queue worker. Unix Timestamp to Date Converter (MySQL, PHP)Convert Unix time to MySQL DATETIME and back in any time zone, with ready PHP, Carbon and SQL snippets. JSON to PHP Array Converter (and back)Turn JSON into a clean PHP array for config files and tests, or turn a PHP array into JSON. Key order kept.