bcrypt Base64 encoder & decoder
“Hello, world!” becomes QETqZE6qGFbtakviGO in bcrypt Base64, the OpenBSD alphabet that starts with period and slash and never adds equals signs, the same form used inside bcrypt salt and digest segments. Free in your browser.
- Free
- Runs in your browser
- No sign-up
- Your data stays on your device
Run — free
Worked example
- Text
- Hello, world!
- Calculation mode
- Encode
- Result
- QETqZE6qGFbtakviGO
- Alphabet
- bcrypt
- Charset
- ./A-Za-z0-9
- Padding
- none
OpenBSD alphabet, free
Encode text with the bcrypt Base64 alphabet
The engine interprets the string as Unicode text, serializes it to UTF-8 bytes, and packs those bytes into six-bit groups exactly like classic Base64, then maps each group through the OpenBSD order period, slash, A through Z, a through z, and zero through nine. When the byte length is not a multiple of three, the final group is emitted with two or three characters and without equals padding, matching the form used inside bcrypt salt and digest segments.
Empty strings are valid and encode to an empty result with zero bytes. Multilingual text, emoji, and punctuation all round-trip because the path is full UTF-8 rather than a Latin-1 shortcut. The response always includes result with the bcrypt Base64 string, mode equal to encode, alphabet equal to bcrypt, charset equal to .
/A-Za-z0-9, padding equal to none, bytes equal to the UTF-8 length before encoding, and length equal to the character count of result so you can assert sizes in tests. Identical inputs always produce identical outputs because the algorithm is pure arithmetic with no network, no random salt, and no wall clock. Use this path whenever you need a paste-safe representation that matches the bcrypt alphabet rather than RFC 4648.
Decode bcrypt Base64 and handle invalid input
Set mode to decode and put a bcrypt Base64 string in text. A length whose modulo four equals one is rejected as malformed; incomplete final groups with non-zero trailing bits are also rejected so clients cannot hide extra bits in the unused low positions. Successful decode returns result as the recovered string, mode decode, alphabet bcrypt, charset .
/A-Za-z0-9, padding none, bytes as the decoded UTF-8 length, and length as the character count of the plaintext. Prefer this capability when your search intent is literally bcrypt Base64 encode or decode for interop and education; standard padding and URL-safe cookies belong to other landings.
Where bcrypt Base64 comes up in practice
Call the free in-browser bcrypt Base64 tool for classroom demos, support playbooks, and one-off conversions without installing OpenSSL or language runtimes. A typical workflow encodes a short test vector to document how a library’s custom alphabet differs from RFC 4648, ships the sample through a ticket system, then decodes it on the receiving service with mode decode and asserts that bytes match the original length. Another workflow verifies that a documentation sample still decodes to the documented plaintext before a release that touches password-hash formatting code.
Authors shipping SDKs can map the result field straight into a copy button, while alphabet and padding labels make screenshots and OpenAPI examples self-explanatory for readers who only know the classic alphabet with equals signs.
FAQ
How do I encode text as bcrypt Base64?
The result field contains bcrypt Base64 using the . /A–Za–z0–9 alphabet with no padding.
How do I decode bcrypt Base64 to text?
Send mode decode and put the bcrypt Base64 string in text.
Is this the same as standard Base64?
No. Bcrypt uses a different 64-character order that starts with ./ and never uses + / or = padding. Standard Base64 strings are rejected on decode.
Does this compute a bcrypt password hash?
No. It only translates data with the bcrypt Base64 alphabet used inside hash strings.
Is the bcrypt Base64 encoder free?
The browser tool runs free on your device.
Related tools
For developers — API access
Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.
API endpoint
Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, by email and from Telegram — and soon from our app too.
Call it from your stack
curl -X POST https://api.kit.forhosting.com/enc/base64-bcrypt \
-H "Authorization: Bearer $KIT_KEY" \
-H "Content-Type: application/json" \
-d '{"text":"Hello, world!"}'const res = await fetch("https://api.kit.forhosting.com/enc/base64-bcrypt", {
method: "POST",
headers: {
"Authorization": `Bearer ${process.env.KIT_KEY}`,
"Content-Type": "application/json"
},
body: JSON.stringify({
"text": "Hello, world!"
})
});
const { task_id } = await res.json();import os, requests
res = requests.post(
"https://api.kit.forhosting.com/enc/base64-bcrypt",
headers={"Authorization": f"Bearer {os.environ['KIT_KEY']}"},
json={
"text": "Hello, world!"
},
)
task_id = res.json()["task_id"]<?php
$res = file_get_contents("https://api.kit.forhosting.com/enc/base64-bcrypt", false, stream_context_create([
"http" => [
"method" => "POST",
"header" => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
"content" => '{"text":"Hello, world!"}',
],
]));
$task = json_decode($res, true);body := bytes.NewBufferString(`{"text":"Hello, world!"}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/enc/base64-bcrypt", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)Example request
{
"text": "Hello, world!"
}Example response
{
"task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
"type": "enc.base64_bcrypt",
"status": "queued",
"_links": {
"result": "/tasks/tsk_…/result"
}
}The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.
Pricing
Published price — no tokens, no invented credits. A failed task is never charged.
Errors
| HTTP | Code | Meaning |
|---|---|---|
401 | unauthorized | Missing or invalid API key. |
402 | insufficient_balance | Your balance doesn't cover the task price. |
404 | unknown_type | That task type doesn't exist. |
429 | rate_limited | Too many requests. Use the webhook instead of polling. |
Technical notes
Bcrypt password hashes do not use the everyday Base64 alphabet you see in JSON tutorials. OpenBSD crypt and crypt_blowfish map six-bit groups onto a sixty-four character set that begins with period and slash, then A through Z, a through z, and digits, and they never append equals signs for padding. That single alphabet reordering is enough to make a standard Base64 decoder reject a salt or digest fragment as garbage, and enough to make a standard encoder produce a string that will never match a real bcrypt field. This capability focuses on that exact conversion job: paste plain UTF-8 text to encode into bcrypt Base64, or paste a bcrypt-alphabet string to decode back to readable text, with a clear invalid input error when the alphabet, length, or UTF-8 payload is wrong. The free browser tool runs entirely on your device for quick checks while you inspect hash layouts or debug interop; the prepaid API exposes the same deterministic contract at $0.002 per successful item for scripts, SDKs, and pipelines that need a stable encode-decode step without pulling a crypto library only for alphabet translation.
Encode text with the bcrypt Base64 alphabet
Send a JSON body with the required string field text set to the plain message you want to represent in the bcrypt alphabet, and leave mode at its default encode or set mode to encode explicitly. Optional aliases input, value, s, and data are accepted for the same field when you generate clients from older form names.
Decode bcrypt Base64 and handle invalid input
Leading and trailing spaces, tabs, and newlines are stripped so multi-line pastes still work, but any character outside the bcrypt alphabet causes an immediate invalid_input failure—the engine does not silently remap standard plus and slash symbols or equals padding, because that would blur the product promise of the OpenBSD alphabet and would invent strings that never appear in real bcrypt fields. After alphabet validation, the recovered bytes are decoded as UTF-8 with a fatal decoder: if the payload is not valid Unicode text, you get invalid_input instead of replacement characters that would corrupt downstream displays. Validation failures are not charged on the prepaid API, so probing a suspicious fragment is cheap for operators and safe for end users.
API usage, pricing, workflows, and practical limits
Use the prepaid KIT API when a backend, serverless function, or SDK needs the same encode or decode step under balance at $0.002 per successful item; failed validation never consumes balance after the engine rejects the request. Pair this endpoint with a standard Base64 tool when you need to show side-by-side alphabet differences, but keep the steps on separate landings so each page matches a single search intent.
Integration use cases
Hash-layout debugging and interop
Encode and decode salt or digest fragments with the OpenBSD bcrypt alphabet so library outputs match the strings you see in $2a$ and $2b$ fields.
Docs and CI golden checks
Pin encode and decode fixtures so documentation samples and continuous-integration tests fail fast if the bcrypt alphabet mapping ever drifts.
Support and education
Agents and students convert text with the free browser widget, with clear invalid_input errors when a paste uses standard +/ or equals padding by mistake.