Bcrypt Hash Generator
Generate bcrypt hashes for secure password storage. Bcrypt is specifically designed for password hashing, with built-in salt and configurable work factor to resist brute-force attacks.
Why Bcrypt for Passwords
| Feature | Bcrypt | SHA-256 | PurposePasswordsGeneral hashing Built-in saltYesNo Adjustable slownessYesNo GPU resistanceGoodPoor | Industry standard | Yes | No (for passwords) |
Bcrypt Hash Format
``
$2b$12$LQv3c1yqBWVHxkd0LHAkCOYz6TtxMQJqhN8/X4beUYqL1qXWvEwZW
│ │ │ │ │
│ │ │ └─ Salt (22 chars) └─ Hash (31 chars)
│ │ └─ Cost factor (2^12 = 4096 rounds)
│ └─ Version (2b)
└─ Algorithm identifier
`
Bcrypt Implementation
`javascript
// Node.js with bcrypt
const bcrypt = require('bcrypt');
// Hash a password
async function hashPassword(password) {
const saltRounds = 12;
return await bcrypt.hash(password, saltRounds);
}
// Verify a password
async function verifyPassword(password, hash) {
return await bcrypt.compare(password, hash);
}
// Usage
const hash = await hashPassword('mySecretPassword');
// "$2b$12$LQv3c1yqBWVHxkd0LHAkCOYz6TtxMQJqhN8/X4beUYqL1qXWvEwZW"
const isValid = await verifyPassword('mySecretPassword', hash);
// true
``
Cost Factor (Salt Rounds)
| Rounds | Time (~) | Recommendation | 10~100msDevelopment minimum 11~200msLight usage 12~400msRecommended default 13~800msHigh security | 14 | ~1.6s | Very high security |
Bcrypt Best Practices
1. Use cost factor 12+ for production 2. Never store plain passwords - always hash 3. Don't use pepper with bcrypt (controversial) 4. Increase cost factor as hardware improves 5. Use constant-time comparison (bcrypt.compare does this)
Bcrypt Limitations
| Limitation | Detail | Max password length72 bytes No keyed hashingCan't use secret key | Single-threaded | Can't parallelize |
Consider Argon2 for new projects (memory-hard, more modern).