bcrypt is a password hashing function based on the Blowfish cipher that incorporates a salt and an adjustable cost factor, making brute-force attacks computationally expensive. Designed by Niels Provos and David Mazieres in 1999, bcrypt remains one of the most widely recommended algorithms for password storage.
Why not use SHA-256 or MD5 for passwords?
General-purpose hash functions like SHA-256 and MD5 are designed to be fast. A modern GPU can compute billions of SHA-256 hashes per second, which means an attacker can brute-force enormous password spaces quickly. bcrypt is deliberately slow — that’s the feature.
How bcrypt works
A bcrypt hash has four components:
$2b$12$LJ3m4ys3Lk0TDcfOaGNoHOxHmMqFMBCBUF8TpQA0BN4lKYq8C7W6y
│ │ │ │
│ │ └── 22-char salt └── 31-char hash
│ └── cost factor (2^12 = 4096 iterations)
└── algorithm version- Version:
$2b$is the current recommended version. - Cost factor: An integer (typically 10-14) that determines how many iterations the algorithm performs. Each increment doubles the computation time.
- Salt: A random 128-bit value generated per hash, stored as part of the output. This prevents rainbow table attacks and ensures identical passwords produce different hashes.
- Hash: The resulting 184-bit digest.
The cost factor
The cost factor is bcrypt’s key advantage. As hardware gets faster, you increase the cost:
- Cost 10: ~100ms per hash (reasonable for most apps today)
- Cost 12: ~400ms per hash
- Cost 14: ~1.6s per hash
This adaptive cost means bcrypt remains secure as CPUs and GPUs improve. Set the cost so that hashing takes 100-500ms on your server — slow enough to deter attackers, fast enough that users don’t notice.
Using bcrypt
In Node.js: bcrypt.hash('password', 12). In Python: bcrypt.hashpw(password, bcrypt.gensalt(rounds=12)). In PHP: password_hash($password, PASSWORD_BCRYPT).
To verify a password, you pass the plaintext and the stored hash to a comparison function: bcrypt.compare('password', storedHash). Never compare hashes with === — use the library’s timing-safe comparison.
bcrypt vs. Argon2
Argon2 (the winner of the 2015 Password Hashing Competition) is considered the stronger choice for new projects. It’s memory-hard, meaning it requires large amounts of RAM per hash, which makes GPU-based attacks much harder. bcrypt is primarily CPU-hard. That said, bcrypt is battle-tested, widely supported, and still perfectly adequate.
Generate and verify bcrypt hashes with the bcrypt Generator. Check password strength with the Password Strength Checker.