That's intentional — bcrypt's cost factor controls how many iterations of key-strengthening are performed, and higher costs deliberately make brute-forcing slower. Cost 12+ may take a few seconds in-browser.
Yes — it's a from-scratch implementation verified against the classic published bcrypt test vectors and cross-checked against a reference library before release, including hashes it generates being independently verified as correct.
Yes — use the "Verify a Password Against a Hash" section to check a password against any bcrypt hash, not just ones generated here.