bcrypt, bcrypt password hashing algorithm
Technical Specifications
- Output Format:
- bcrypt format (salt + hash combined, 60 characters)
- Security Level:
- High - Blowfish-based, adaptive cost factor
- Cost Factor:
- Salt rounds (4-31), can be increased over time
- Hash Length:
- 184 bit (23 bytes) hash + salt + metadata
Usage Areas
- Password storage and verification
- Authentication systems
- Web application password hashing
- Database password encryption
Features
- Adaptive cost factor: Can be increased over time (for future security)
- Automatic salt: Each hash contains a unique salt
- Intentional slowness: Protection against brute-force attacks
- Blowfish-based: Trusted encryption algorithm
- Same password, different hash: Each hash is unique due to salt
Standards and References
- bcrypt algorithm (widespread use)
⚠️ Important Warnings
- Cost factor should be sufficiently high (minimum 10, preferably 12+)
- Modern applications may prefer more secure algorithms like Argon2 or scrypt
- Passwords should never be stored in plain text