Bcrypt
What is a Bcrypt?
Bcrypt is a password-hashing function based on the Blowfish cipher, designed in 1999 to be deliberately slow. Its adjustable cost factor lets you make hashing more expensive as hardware gets faster, which slows down brute-force attacks on stolen password databases. It remains one of the most widely used password hashes in web frameworks.
How to use it
- Enter a password and choose the cost (salt rounds). 10 to 12 is typical.
- Generate the hash and copy it.
- To verify, paste an existing bcrypt hash and a password and check whether they match.
Reading a bcrypt hash
A hash like $2b$12$R9h/cIPz0gi.URNNX3kh2OPST9/PgBkqquzi.Ss7KIUgO2t0jWMUW has three parts: $2b$ is the version, 12 is the cost (2^12 = 4096 rounds of key expansion), and the next 22 characters are the random salt, followed by the 31-character hash. Because the salt is random, hashing the same password twice gives different results; that is expected.
Choosing a cost factor
Each increase of 1 doubles the work. Aim for roughly 100 to 300 ms per hash on your production servers. Too low makes cracking easier; too high slows logins and can make your login endpoint a denial-of-service target.
Limitations to know
- Bcrypt only uses the first 72 bytes of the password. Longer inputs are silently truncated.
- For new systems, OWASP recommends Argon2id first, with bcrypt as an acceptable alternative.
- Never use MD5 or plain SHA-256 to store passwords; they are far too fast.
Frequently Asked Questions
Why does the same password give a different bcrypt hash each time?
A new random salt is generated for every hash. The salt is stored inside the hash string, so verification still works.
What cost factor should I use?
Choose the highest value that keeps a single hash around 100 to 300 milliseconds on your servers. Many applications use 10 to 12.
What is the difference between $2a$, $2b$ and $2y$?
They are revisions of the format that fix historical implementation bugs. Modern libraries produce $2b$ and can verify all three.
Can a bcrypt hash be decrypted?
No. Bcrypt is a one-way function. A password can only be checked by hashing a guess and comparing.