What Is Bcrypt?
Bcrypt is a password hashing function designed by Niels Provos and David Mazieres in 1999. It is based on the Blowfish cipher and incorporates a salt to protect against rainbow table attacks and an adaptive cost factor that makes it resistant to brute-force attacks even as computing power increases over time. Bcrypt has become the industry standard for secure password storage and is recommended by OWASP, NIST, and virtually all security authorities.
Unlike general-purpose hash functions like SHA-256, which are designed for speed, bcrypt is deliberately slow. This is a feature, not a bug. The purpose of password hashing is to make it as expensive as possible for an attacker to test password guesses against a stolen hash database. Bcrypt achieves this through key stretching: it applies the Blowfish key schedule 2^cost times, where the cost parameter determines how slow the function is.
In 2026, with GPU-based password crackers capable of testing billions of SHA-256 hashes per second, using a password-specific hashing function like bcrypt is not optional — it is a minimum requirement for responsible password storage. Our Bcrypt Generator tool demonstrates the concept by generating valid bcrypt hashes.
The Role of Salting
A salt is a random, unique value that is combined with the password before hashing. Salting is essential for several reasons:
1. Preventing Rainbow Table Attacks
A rainbow table is a precomputed table of hashes for every possible password (up to a certain length). Without a salt, an attacker who steals a database of password hashes can simply look up each hash in their rainbow table to find the password. With a salt, the attacker would need a separate rainbow table for every possible salt, which is computationally infeasible.
2. Ensuring Unique Hashes
If two users have the same password, without salting, their hashes would be identical. This leaks information: an attacker knows those users share the same password. With a unique salt per user, even identical passwords produce completely different hashes.
3. Increasing Attack Complexity
Bcrypt automatically generates a cryptographically random salt for each password hash. The salt is stored as part of the output hash, so you do not need to manage it separately. This salt increases the total length of the hash and ensures that attacks must target individual hashes rather than the entire database.
Bcrypt uses a 128-bit (16-byte) salt, which is the recommended minimum by all security standards. The salt ensures that even if two users choose the password "password123", their stored bcrypt hashes will be completely different.
Understanding the Cost Factor
The cost factor (also called work factor or log-rounds) is the most important parameter in bcrypt. It determines how computationally expensive the hashing operation is. The cost is expressed as a power of two: a cost of 10 means 2^10 = 1,024 rounds of Blowfish key expansion. A cost of 12 means 2^12 = 4,096 rounds.
| Cost | Rounds | Approx. Time (modern CPU) | Security Level |
|---|---|---|---|
| 8 | 256 | ~50 ms | Minimum (legacy) |
| 10 | 1,024 | ~80 ms | Acceptable (2010s) |
| 12 | 4,096 | ~250 ms | Recommended (2020s) |
| 14 | 16,384 | ~1 second | Strong |
| 16 | 65,536 | ~4 seconds | Very high security |
How to Choose the Right Cost
The ideal cost factor balances security with user experience. A good rule of thumb in 2026: choose the highest cost that keeps the hash computation under 500 milliseconds on your production hardware. For most applications, a cost of 12 is the recommended starting point. If your application has higher security requirements or your users are less sensitive to login delays, increase the cost to 14.
As hardware improves over time, you can increase the cost factor. When a user logs in successfully, you can detect that their stored hash uses an outdated cost and automatically re-hash the password with a higher cost. This transparent upgrade path means your password security improves over the lifetime of your application.
Bcrypt Hash Format
A bcrypt hash has a specific, structured format that encodes all the parameters needed for verification:
Breaking this down:
$2b$— Version identifier.$2a$(original),$2b$(fixed, current standard),$2x$and$2y$(transitional variants).12— Cost factor (2^12 = 4,096 rounds)ABCDEFGHIJKLMNOPQRSTUVWXYZ— 22 characters of base64-encoded salt (128 bits)abcdefghijklmnopqrstuvwxyz01— 31 characters of base64-encoded hash (184 bits)
Total length: 60 characters. The hash is self-contained: it includes the version, cost, salt, and actual hash value. To verify a password, you extract these components from the stored hash and recompute it with the user's provided password.
Why Bcrypt Over Other Hashing Methods
Bcrypt vs MD5 and SHA-*
MD5 and SHA-* are general-purpose cryptographic hash functions optimized for speed. On a modern GPU, an attacker can compute billions of MD5 or SHA-256 hashes per second. A password like "Tr0ub4dor&3" (14 characters, mixed types) can be cracked from its SHA-256 hash in minutes using a GPU cluster. Bcrypt with cost 12 reduces the attacker's speed to a few hundred hashes per second, making the same password effectively uncrackable.
Bcrypt vs PBKDF2
PBKDF2 (Password-Based Key Derivation Function 2) is another popular password hashing function. It uses a configurable number of iterations. However, PBKDF2 is efficiently implementable on GPUs and ASICs, which reduces its advantage. Bcrypt's memory requirements (4 KB of RAM per operation) make GPU-based attacks significantly more expensive.
Bcrypt vs Argon2
Argon2 is the winner of the 2015 Password Hashing Competition and is considered more secure than bcrypt. It offers tunable memory usage (resistant to GPU and ASIC attacks) and parallelization parameters. However, bcrypt remains far more widely supported across languages, frameworks, and platforms. In 2026, Argon2 is recommended for new systems, but bcrypt remains an excellent choice for maximum compatibility with existing infrastructure.
When to Use Bcrypt vs Scrypt
Scrypt is similar to bcrypt in being memory-hard, but it uses significantly more memory by design. Bcrypt uses a fixed 4 KB of memory, while scrypt can be configured to use megabytes. For most applications, bcrypt provides sufficient security with better performance characteristics.
Real-World Examples
Example 1: User Registration Flow
Scenario: A web application needs to implement user registration with secure password storage.
Challenge: Passwords must be stored in a way that protects users even if the database is breached.
Solution: When a user submits the registration form with a password, the server generates a bcrypt hash with cost 12. The hash (including the automatically generated salt) is stored in the database. The original password is discarded immediately. When the user logs in, the server retrieves the stored hash, extracts the salt and cost, and recomputes the hash with the provided password. If the hashes match, the user is authenticated.
Example 2: Legacy Upgrade from MD5
Scenario: A company discovers their user database stores passwords as unsalted MD5 hashes. They need to migrate to bcrypt without forcing all users to reset passwords.
Challenge: MD5 is instantaneous to compute. Even if the hashes are upgraded, the original passwords are weak.
Solution: On each user's next login, the application detects the old MD5 format, verifies the password against it, and immediately replaces the stored hash with a new bcrypt hash (cost 12) computed from the password. Over time, as all active users log in, the database is fully migrated. Inactive accounts eventually get recycled or prompted for password reset.
Example 3: API Key Verification
Scenario: A SaaS platform generates API keys for customers. The keys must be stored securely but verified on every API call.
Challenge: API key verification happens on every request and must be fast, but the keys must remain secure if the database is leaked.
Solution: API keys are generated with high entropy (use a UUID generator with extra random bytes). The bcrypt cost is set to 10 (lower for speed since verification is on every request, but the high entropy of the keys compensates for the lower cost). The original key is shown only once at creation time; only the hash is stored. Even if the database is compromised, attackers gain nothing of value.
Frequently Asked Questions
Q: Is bcrypt still secure in 2026?
A: Absolutely. Bcrypt remains one of the most widely recommended password hashing functions. With a cost factor of 12 or higher, bcrypt provides excellent protection against brute-force attacks. For new systems, consider Argon2, but bcrypt is still a very strong choice.
Q: What cost factor should I use?
A: Start with cost 12. Measure the computation time on your hardware. If it is under 500ms, consider increasing to 13 or 14. The highest cost that does not negatively impact user experience is the right choice.
Q: Can I increase the cost factor later?
A: Yes. When a user logs in successfully, check if their stored hash uses the current cost factor. If not, re-hash the password (which the user just provided in plain text) with the new cost and update the stored hash. This transparently upgrades security over time.
Q: Is it safe to use an online bcrypt generator?
A> For educational purposes, yes. Our tool is purely educational and demonstrates what a bcrypt hash looks like. For production use, always hash passwords on your own server using a well-tested library like bcrypt for Node.js, Python's bcrypt package, or Java's jBCrypt.
Q: Can I use the same salt for all passwords?
A: Never. Every password must have a unique salt. Bcrypt automatically generates a random salt for each hash — you do not need to manage salts separately. If you manually provide salts, ensure they are cryptographically random and unique per user.
Q: What is the maximum password length for bcrypt?
A: Bcrypt has a maximum input length of 72 bytes (not characters). For passwords longer than 72 characters, the excess is silently truncated. If you need longer passwords, pre-hash them with SHA-256 and then bcrypt the hash. However, passwords over 72 characters are already extremely strong.
Ready to Learn More About Bcrypt?
Use our free online hash generator to understand how different hashing algorithms work, and then read our password generator guide to create strong passwords worth hashing:
- Understand bcrypt hash structure with real examples
- Learn the difference between hashing algorithms
- Create strong passwords worth protecting
- All browser-based, no data leaves your device