bcrypt

bcrypt is a password hashing function designed in 1999 by Niels Provos and David Mazières based on the Blowfish cipher. It incorporates an automatic salt (preventing rainbow table attacks) and a configurable cost factor (making the hash computation take a tunable amount of time). The cost factor can be increased as hardware improves, keeping bcrypt resistant to brute-force attacks over time.

Why bcrypt for Passwords

Fast hash functions like SHA-256 can compute billions of hashes per second on a GPU. An attacker with access to a leaked hash database can try billions of candidate passwords quickly. bcrypt is designed to be slow — a cost factor of 12 takes approximately 250ms on modern hardware, reducing an attacker to approximately 4 hash attempts per second per GPU core.

Cost Factor

The cost factor N means bcrypt performs 2^N iterations internally:

Cost	Iterations	~Time (modern CPU)
10	1,024	~65ms
12	4,096	~250ms
14	16,384	~1000ms

OWASP recommends a cost factor of 10 minimum; use 12 if login latency allows. Increase the cost factor as your hardware speeds up.

Hash Format

bcrypt produces a 60-character string that includes everything needed to verify the password:

$2b$12$LQv3c1yqBWVHxkd0LHAkCOYz6TtxMQJqhN8/LewdBPj0osBzVF84a

$2b$  — algorithm version (2b is current)
12$   — cost factor (2^12 iterations)
LQv3c1yqBWVHxkd0LHAkCO — 22-char salt (128 bits, Base64)
Yz6TtxMQJqhN8/LewdBPj0osBzVF84a — 31-char hash (184 bits, Base64)

Usage in Node.js

import bcrypt from "bcrypt";

const COST = 12;

// Hash a password (store this in your database)
const hash = await bcrypt.hash(plainTextPassword, COST);

// Verify on login
const isValid = await bcrypt.compare(plainTextPassword, storedHash);
if (!isValid) throw new Error("Invalid credentials");

Limitations

• Truncates passwords at 72 bytes — longer passwords are silently truncated
• Output is fixed at 60 characters
• Not parallelizable (intentional — prevents GPU optimization)
• Cannot tune memory requirements (unlike Argon2)

bcrypt vs Argon2

For new projects, Argon2id is preferred over bcrypt. Argon2 won the Password Hashing Competition (2015), supports configurable memory requirements, and has no 72-byte password truncation. Use bcrypt for existing systems where migration is costly.