Bcrypt Hash Generator
Generate bcrypt hashes for secure password storage. Bcrypt is specifically designed for password hashing, with built-in salt and configurable work factor to resist brute-force attacks.
Why Bcrypt for Passwords
| Feature | Bcrypt | SHA-256 |
|---|---|---|
| Purpose | Passwords | General hashing |
| Built-in salt | Yes | No |
| Adjustable slowness | Yes | No |
| GPU resistance | Good | Poor |
| Industry standard | Yes | No (for passwords) |
Bcrypt Hash Format
``
$2b$12$LQv3c1yqBWVHxkd0LHAkCOYz6TtxMQJqhN8/X4beUYqL1qXWvEwZW
│ │ │ │ │
│ │ │ └─ Salt (22 chars) └─ Hash (31 chars)
│ │ └─ Cost factor (2^12 = 4096 rounds)
│ └─ Version (2b)
└─ Algorithm identifier
`
Bcrypt Implementation
`javascript
// Node.js with bcrypt
const bcrypt = require('bcrypt');
// Hash a password
async function hashPassword(password) {
const saltRounds = 12;
return await bcrypt.hash(password, saltRounds);
}
// Verify a password
async function verifyPassword(password, hash) {
return await bcrypt.compare(password, hash);
}
// Usage
const hash = await hashPassword('mySecretPassword');
// "$2b$12$LQv3c1yqBWVHxkd0LHAkCOYz6TtxMQJqhN8/X4beUYqL1qXWvEwZW"
const isValid = await verifyPassword('mySecretPassword', hash);
// true
``
Cost Factor (Salt Rounds)
| Rounds | Time (~) | Recommendation |
|---|---|---|
| 10 | ~100ms | Development minimum |
| 11 | ~200ms | Light usage |
| 12 | ~400ms | Recommended default |
| 13 | ~800ms | High security |
| 14 | ~1.6s | Very high security |
Bcrypt Best Practices
1. Use cost factor 12+ for production 2. Never store plain passwords - always hash 3. Don't use pepper with bcrypt (controversial) 4. Increase cost factor as hardware improves 5. Use constant-time comparison (bcrypt.compare does this)
Bcrypt Limitations
| Limitation | Detail |
|---|---|
| Max password length | 72 bytes |
| No keyed hashing | Can't use secret key |
| Single-threaded | Can't parallelize |