What Is Bcrypt?

Bcrypt is a password hashing function designed by Niels Provos and David Mazières in 1999, based on the Blowfish cipher. It is one of the most widely recommended algorithms for securely storing passwords. Unlike fast hashing algorithms such as MD5 or SHA-256, Bcrypt is deliberately slow and computationally expensive, which makes brute-force and rainbow table attacks far less practical.

The key innovation of Bcrypt is its adaptive cost factor — also called the work factor or rounds. As hardware gets faster over time, you increase the cost factor to keep the same resistance against attackers. That built-in future-proofing is why Bcrypt is still a sensible default for password storage decades after it was created.

A short history of Bcrypt

Before Bcrypt, systems commonly stored passwords using fast hashes such as MD5 and SHA-1, sometimes with a shared salt. That approach aged badly: fast hashes let attackers test billions of candidates per second on commodity GPUs. Bcrypt was designed to make each guess expensive while remaining tunable, so it could grow with hardware.

How Bcrypt works

Bcrypt combines several security mechanisms:

Salt generation. Bcrypt automatically generates a random 16-byte salt for each password. This means identical passwords produce different hashes, which defeats rainbow tables and hides users who share the same password.

Cost factor. The cost factor (denoted 2^rounds) sets how many iterations of the key derivation run. A cost of 10 means 2^10 = 1,024 iterations. Every extra round doubles the work, so brute-force cost grows exponentially.

Blowfish key schedule. Bcrypt uses the Blowfish cipher's expensive key schedule (EksBlowfish) to do the work. The memory and CPU cost make GPU and ASIC attacks much less effective than against SHA-based schemes.

A Bcrypt hash typically looks like this:

$2b$10$3euPcmQFCiblsZeEu5s7p.9vHnhJ3X7e3Qh7vA7z6YnF5qX5Q5aK

Breaking it down:

• $2b$ — algorithm version (2a, 2b, 2x, 2y)
• 10 — cost factor (2^10 iterations)
• 3euPcmQFCiblsZeEu5s7p. — 22-character salt (base64)
• 9vHnhJ3X7e3Qh7vA7z6YnF5qX5Q5aK — 31-character hash

Notice that everything needed to verify the password is stored inside the hash string, so you never manage salts separately.

Bcrypt vs other password hashing algorithms

For new applications, Argon2id is often the best choice. Bcrypt remains an excellent, battle-tested option — especially where Argon2 support is not available. Avoid PBKDF2 unless a compliance requirement forces it.

The 72-byte input limit

Bcrypt only reads the first 72 bytes of a password. Bytes beyond that are ignored, which means two long passwords sharing a 72-byte prefix produce the same hash. Two safe options are:

1. Pre-hash the password with SHA-256 and base64-encode it before passing it to Bcrypt. This is the approach used by Dropbox.
2. Enforce a maximum password length in your application and validate it on input.

Never silently truncate: if your framework rejects long passwords, tell the user.

Choosing a cost factor

The goal is a cost that takes roughly 100–500 ms per hash on your production hardware. A common starting point is cost 10, but benchmark it:

• Too low → fast for attackers as well as you
• Too high → login latency and CPU spikes under load

Recompute and raise the cost every few years as hardware improves. Because the cost is stored in each hash, you can upgrade users transparently on their next successful login (rehash with the new cost and save).

Code examples

// PHP — hash and verify
$hash = password_hash($password, PASSWORD_BCRYPT, ['cost' => 12]);

if (password_verify($password, $storedHash)) {
    // Rehash with a higher cost if needed
    if (password_needs_rehash($storedHash, PASSWORD_BCRYPT, ['cost' => 12])) {
        $newHash = password_hash($password, PASSWORD_BCRYPT, ['cost' => 12]);
    }
}

// Node.js
const bcrypt = require('bcrypt');
const hash = await bcrypt.hash(password, 12);
const ok = await bcrypt.compare(password, hash);

# Python
import bcrypt
hashed = bcrypt.hashpw(password.encode(), bcrypt.gensalt(rounds=12))
ok = bcrypt.checkpw(password.encode(), hashed)

Bcrypt best practices

1. Use a cost factor of 10–12 as a baseline and tune it to your hardware.
2. Always use the latest revision — $2b$, or $2y$ for PHP — instead of the older $2a$.
3. Never implement Bcrypt yourself. Use well-vetted libraries such as PHP's password_hash.
4. Compare with a constant-time function. All mature libraries do this for you.
5. Always hash over HTTPS so plaintext passwords never traverse the network.
6. Rate-limit login attempts — hashing cost does not protect against online guessing alone.

Common mistakes

• Using MD5/SHA for passwords. Fast hashes are the wrong tool; use Bcrypt, scrypt or Argon2.
• Storing a salt in a separate column. Bcrypt already embeds the salt in the hash.
• Ignoring the 72-byte limit without pre-hashing or validating length.
• Setting cost too high and causing CPU exhaustion and timeouts under load.
• Rolling your own comparison instead of using a constant-time verify function.

Frequently asked questions

Is Bcrypt still safe in 2026? Yes. Bcrypt has no practical breaks when used correctly. Argon2id is more modern, but Bcrypt remains a strong, widely supported choice.

What cost factor should I use? Pick the highest cost that keeps hashing under roughly 250–500 ms on your servers. Cost 10–12 is a common range.

Can I migrate my existing hashes to Argon2? Yes. Verify the old hash on the user's next login, then rehash with the new algorithm and update the stored value.

Does Bcrypt work for API keys or tokens? No. Those are high-entropy secrets; store a SHA-256 hash of the token instead and compare in constant time.

Why does my hash start with $2y$? PHP uses $2y$ to denote a compatible Bcrypt variant. It is functionally equivalent to $2b$.

Generate Bcrypt hashes online

If you need to test Bcrypt hashing or generate hashes for development purposes, our free Bcrypt Generator lets you hash passwords instantly with a configurable cost factor. It is perfect for developers setting up test databases, verifying implementations, or learning how Bcrypt works.

Conclusion

Bcrypt remains one of the most trusted password hashing algorithms available. Its adaptive design, automatic salting and proven security make it the right choice for protecting user credentials in almost any application — and for teams that want the newest options, Argon2id is worth evaluating alongside it.