BCrypt Password Hashing Explained
BCrypt Hashing
When to Use BCrypt
BCrypt is designed for password hashing with a tunable cost factor that slows brute-force attacks. Use this tool to generate test hashes — production password hashing should always happen on your server.
Real-World Examples
Hash output: $2b$10$N9qo8uLOickgx2ZMRZoMye...
Cost 10 — common default (~100ms per hash on modern hardware)
Seed database fixtures with known password hashes for integration tests
Common Mistakes
- Using SHA-256 or MD5 for passwords — too fast for password storage
- Cost factor too low — vulnerable to offline brute force as hardware improves
- Hashing passwords client-side before sending — use HTTPS and hash server-side
Developer Tips
- Node.js:
bcrypt.hash(password, 10) - Increase cost over time as CPUs get faster — rehash on login when cost is outdated
- Consider Argon2id for new projects — BCrypt remains widely supported
Frequently asked questions
What cost factor should I use?
10 is the common default. Higher values are slower but more resistant to brute force. Target roughly 100–250ms per hash on your server.
What does the $2b$ prefix mean?
It identifies the BCrypt variant and algorithm version. The number after it (e.g. 10) is the cost factor (2^10 iterations).
Can I verify passwords with this tool?
This tool generates hashes. Use your application bcrypt.compare() or equivalent to verify passwords against stored hashes.