📣 Join the free Cloudways Performance Bootcamp (Mar 10–11) — Fix slow sites live Register Now

Cloud Hosting Glossary

Struggling to tell your APIs from your CDNs? Read our comprehensive cloud computing glossary covering the most common terms.

< Back to glossary

Bcrypt

Bcrypt is a cryptographic hashing algorithm specifically designed for securely hashing passwords. Developed in 1999 by Niels Provos and David Mazières, it is based on the Blowfish cipher and includes features like salting and an adjustable cost factor to protect against brute-force and dictionary attacks.

How Bcrypt Works:

Password Hashing: Bcrypt converts a plaintext password into a fixed-length hashed string using a one-way hashing function. This means the original password cannot be reversed from the hash.

Salting: A unique, random 16-byte salt is added to each password before hashing. This ensures that even if two users have the same password, their hashes will differ, preventing rainbow table attacks.

Cost Factor (Work Factor): Bcrypt uses an adjustable cost parameter that determines how many iterations the hashing function performs. Higher cost factors increase the time and computational resources required, making brute-force attacks significantly more difficult.

Output Format: The final hash includes the algorithm identifier (e.g., $2a$), the cost factor, the salt, and the hashed password.

Key Features of Bcrypt:

Adaptive Function: The cost factor can be increased over time to keep up with advancements in computing power.

Resistance to Attacks: Salting and iterative hashing make it resistant to dictionary attacks, rainbow tables, and brute-force attempts.

Cross-Language Support: Implemented in various programming languages like Python, JavaScript, PHP, and Java.

Benefits of Bcrypt:

Enhanced Security: Protects passwords even if a database is compromised.

Unique Hashes: Salting ensures every password hash is unique, even for identical passwords.

Future-Proofing: Adjustable cost factor allows adapting to increasing computational power.

Challenges of Bcrypt:

Performance Overhead: Its slow hashing process can impact performance in systems with high authentication traffic.

Password Length Limitations: Supports passwords up to 72 bytes; longer passwords are truncated.

Real-World Example:

A web application uses Bcrypt to hash user passwords before storing them in its database. When a user logs in, their entered password is hashed again using the same salt and compared with the stored hash. If they match, access is granted.