What cost factor should I use?

As of 2026, cost ≥ 12 is recommended — about 250ms per hash on a typical server. Mobile devices can stick with 10. Each +1 doubles the time.

Why bcrypt instead of SHA-256?

SHA is too fast — GPUs can compute billions of hashes per second. bcrypt is deliberately slow (tunable cost) and auto-generates a fresh salt for every hash.

Yes — argon2id won the 2015 Password Hashing Competition and is memory-hard, so it resists GPU attacks. For new projects argon2id is preferred. bcrypt still wins on library availability across languages and DBs.

Bcrypt Hash

Example

Input (password + cost)

Password: password
Cost (rounds): 10

Output (bcrypt hash)

$2b$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy

Note

`$2b$` is the algorithm version, `10` is the cost factor (2¹⁰ = 1024 rounds). The hash embeds salt + cost, so verification needs no separate storage.

Usage / FAQ

When to use

Generate password hashes for storage (learning / testing)
Inspect the cost factor of an existing bcrypt hash
Verify whether a candidate password matches a stored hash
Tune cost — target ~100ms server-side per hash
Compare with argon2 and scrypt while learning

FAQ

Q.What cost factor should I use?: A.As of 2026, cost ≥ 12 is recommended — about 250ms per hash on a typical server. Mobile devices can stick with 10. Each +1 doubles the time.
Q.Why bcrypt instead of SHA-256?: A.SHA is too fast — GPUs can compute billions of hashes per second. bcrypt is deliberately slow (tunable cost) and auto-generates a fresh salt for every hash.
Q.Isn't argon2 better?: A.Yes — argon2id won the 2015 Password Hashing Competition and is memory-hard, so it resists GPU attacks. For new projects argon2id is preferred. bcrypt still wins on library availability across languages and DBs.

Fun facts

bcrypt traces back to Niels Provos and David Mazières's 1999 USENIX paper 'A Future-Adaptable Password Scheme.' The core idea — 'just bump the work factor when hardware gets faster' — has held up for 25 years and counting.
USENIX 1999 — Provos & Mazières
bcrypt uses 'eksblowfish' (Expensive Key Setup Blowfish), a deliberately slowed-down Blowfish key schedule. It bottlenecks on the 4 KB internal cache and memory latency rather than raw ALU speed, which is why it resists GPU/ASIC attacks better than SHA-family hashes.
Wikipedia — bcrypt
The `$2a$` `$2b$` `$2y$` prefixes are all the same algorithm at different revisions. A 2011 sign-extension bug in PHP's bcrypt implementation forced a `$2x$`/`$2y$` split, and OpenBSD later moved from `$2a$` to `$2b$`. Libraries accept every prefix on verify.
Openwall — bcrypt sign-extension bug

See all in this category →

Input (password + cost)

Output (bcrypt hash)

Note

When to use

FAQ

Related tools