The Password Hashing Problem
The fundamental challenge with passwords is that you need to verify them without storing the plaintext. The naive solution — hashing with MD5 or SHA-256 — fails for a specific reason: these hash functions are designed to be fast, and fast hash functions are vulnerable to brute-force attacks.
A modern GPU can compute 10 billion MD5 hashes per second. Given a leaked database of MD5-hashed passwords, an attacker can check every common password, every word in a dictionary, and every short combination in minutes.
Bcrypt solves this by being intentionally slow.
What Bcrypt Is
Bcrypt was designed by Niels Provos and David Mazières in 1999, based on the Blowfish cipher. Unlike SHA-256, which is optimised for speed, bcrypt is designed to be computationally expensive.
A bcrypt hash looks like this:
$2b$12$LQv3c1yqBWVHxkd0LHAkCOYz6TtxMQJqhN8/lewkT7V7z5FMl0i.m
The parts are:
$2b$— bcrypt version identifier12— the cost factorLQv3c1yqBWVHxkd0LHAkCO— 22 characters of base64-encoded salt (128 bits)Yz6TtxMQJqhN8/lewkT7V7z5FMl0i.m— the hash
The Cost Factor: Future-Proofing Security
The cost factor (also called the work factor) controls how many iterations the algorithm performs. A cost of 10 means 2^10 = 1,024 iterations. A cost of 12 means 2^12 = 4,096 iterations. Each increase by 1 doubles the computation time.
This is bcrypt's key innovation. As hardware gets faster, you increase the cost factor to keep verification time in the range of 100–300 ms. An attacker's hardware gets faster too, but so does yours — and you only need to re-hash passwords when users next log in.
Current recommendation: cost factor 12 for most applications. Use 14 for high-security contexts. Do not go below 10.
Salting Is Automatic
Unlike MD5 or SHA-256, bcrypt includes a random salt automatically. The salt is part of the output hash string, so you do not need to store it separately. This prevents rainbow table attacks: two users with the same password have different hashes.
Bcrypt Limitations
Password truncation. Most bcrypt implementations truncate input at 72 bytes. Passwords longer than 72 characters are not fully used. This is rarely a practical concern but is worth knowing.
Not suitable for large data. Bcrypt is designed for passwords (short inputs). Do not use it to hash files or arbitrary data.
Modern Alternatives
Argon2 (winner of the Password Hashing Competition in 2015) is considered the current state-of-the-art. It offers memory-hardness as well as time-hardness, making it resistant to GPU and ASIC attacks. Argon2id is the recommended variant.
scrypt is another memory-hard alternative, also widely used.
For new applications, prefer Argon2id. For existing applications using bcrypt with a reasonable cost factor, bcrypt remains secure and there is no urgent need to migrate.
Try It
The Bcrypt tool on Syntaxly lets you hash passwords and verify them against existing hashes, all in the browser. Cost factor is configurable. Nothing leaves the page.