Back to DevTools Blog
5 min readUpdated July 2026

Bcrypt Cost Factor Guide: How to Select the Ideal Work Factor for Password Security

Learn how the bcrypt cost factor (log2 iterations) works, how to benchmark hashing latency on server infrastructure, and password hashing security standards.

bcrypt work factor cost tuning guide benchmarkbcrypt cost factor recommended 2026bcrypt hash generator online securitypassword hashing speed vs security cost factorbcrypt log2 round calculation

What is the Bcrypt Cost Factor?

Bcrypt uses an adaptive key derivation function based on the Blowfish cipher. The cost factor parameter defines the log2 number of key expansion rounds performed (2^cost).

For example, cost 10 performs 2^10 = 1,024 iterations, while cost 12 performs 2^12 = 4,096 iterations. Every increase of 1 in cost factor doubles the CPU computation time required to hash or verify a password.

Recommended Cost Factor Benchmarks for Modern Servers

As hardware speed increases, legacy cost factors (like 4 or 8) become vulnerable to GPU-accelerated dictionary attacks. OWASP recommends a cost factor that takes between 250ms to 500ms on your authentication server.

For general web applications, a cost factor of 10 to 12 offers an ideal balance between brute-force protection and CPU load during spikes in login requests.

Salt Generation and Re-Hashing Upgrades

Bcrypt automatically incorporates a cryptographically secure 128-bit random salt into the hash string (e.g., "$2b$12$eImiTXuWVfxh0Vi..."). This prevents precomputed rainbow table attacks.

When upgrading cost factors on existing user accounts, re-hash the password upon successful login when verifying older hashes.

Open the matching tool

Open Bcrypt Generator

Take the idea from the article and turn it into a live calculation or transformation with one click.

Open tool
Research sources

FAQs

Is cost factor 10 secure enough for password hashing?

Yes, cost factor 10 to 12 is currently the standard for web application user authentication, providing strong protection against brute-force attacks.

Why not use SHA-256 for passwords?

SHA-256 is designed for extreme execution speed (gigabytes per second), which enables attackers to test billions of candidate passwords per second on GPUs. Bcrypt is deliberately slow and memory-hard.

More guides