Bcrypt Cost Factor Guide: How to Select the Ideal Work Factor for Password Security
Learn how the bcrypt cost factor (log2 iterations) works, how to benchmark hashing latency on server infrastructure, and password hashing security standards.
What is the Bcrypt Cost Factor?
Bcrypt uses an adaptive key derivation function based on the Blowfish cipher. The cost factor parameter defines the log2 number of key expansion rounds performed (2^cost).
For example, cost 10 performs 2^10 = 1,024 iterations, while cost 12 performs 2^12 = 4,096 iterations. Every increase of 1 in cost factor doubles the CPU computation time required to hash or verify a password.
Recommended Cost Factor Benchmarks for Modern Servers
As hardware speed increases, legacy cost factors (like 4 or 8) become vulnerable to GPU-accelerated dictionary attacks. OWASP recommends a cost factor that takes between 250ms to 500ms on your authentication server.
For general web applications, a cost factor of 10 to 12 offers an ideal balance between brute-force protection and CPU load during spikes in login requests.
Salt Generation and Re-Hashing Upgrades
Bcrypt automatically incorporates a cryptographically secure 128-bit random salt into the hash string (e.g., "$2b$12$eImiTXuWVfxh0Vi..."). This prevents precomputed rainbow table attacks.
When upgrading cost factors on existing user accounts, re-hash the password upon successful login when verifying older hashes.
Open Bcrypt Generator
Take the idea from the article and turn it into a live calculation or transformation with one click.
Open toolFAQs
Is cost factor 10 secure enough for password hashing?
Yes, cost factor 10 to 12 is currently the standard for web application user authentication, providing strong protection against brute-force attacks.
Why not use SHA-256 for passwords?
SHA-256 is designed for extreme execution speed (gigabytes per second), which enables attackers to test billions of candidate passwords per second on GPUs. Bcrypt is deliberately slow and memory-hard.
JSON Formatter Online: How to Validate, Pretty-Print, and Fix Parse Errors
A practical guide to formatting JSON, spotting syntax mistakes, and understanding why JSON.parse fails.
cURL to Fetch Converter: Turn API Examples into Browser Code
Use cURL as a source of truth, then translate it into Fetch-ready JavaScript for browser apps and modern tooling.
JWT Decoder: Read Header and Payload Without Verifying the Signature
Learn what a JWT contains, why it is Base64URL-encoded, and when decoding is not the same as verifying.