Hashing · Blowfish cipher
bcrypt
bcrypt is an adaptive password hash based on Blowfish with a tunable cost factor.
Key facts
| Based on | Blowfish cipher |
|---|---|
| Output | 60-character string with salt |
| Cost | 4 to 31; each step doubles work |
| Input limit | 72 bytes |
| Salt | 16 bytes, stored in the hash |
| Memory | Small; not memory-hard |
Adaptive by design
bcrypt includes a salt and a cost parameter in the stored string. Increasing the cost by one doubles the work, so the algorithm can keep pace with faster hardware. The salt defeats precomputed tables, and the cost makes each guess expensive.
The 72-byte input limit is a real constraint. Longer passwords are truncated, and some libraries silently ignore the rest. Pre-hashing with SHA-256 before bcrypt is a common workaround, but it changes the construction and must be done consistently.
Strengths and limits
bcrypt is compact and has been analysed for decades. It is not memory-hard, so GPUs and specialized hardware can still test many guesses in parallel. Argon2id and scrypt raise the memory cost and are preferable for new systems when available.
Choose a cost that takes roughly 100–300 ms on your server, and raise it as hardware improves. Store the full hash string; it already contains the algorithm, cost and salt.
Frequently asked questions
What does the cost factor mean?
It is a base-2 exponent. Cost 12 means 2^12 iterations; each increment doubles the work.
Is bcrypt still recommended?
It remains acceptable, especially where Argon2id is unavailable. Use a strong cost and respect the 72-byte limit.