Bcrypt is a password hashing function designed to be slow and computationally expensive, making it resistant to brute-force attacks. It's the industry standard for securely storing passwords.
How Bcrypt Works
Bcrypt uses the Blowfish cipher with a salt and cost factor. The cost factor (rounds) determines how many iterations the algorithm performs - each increment doubles the computation time, making attacks exponentially harder.
Why Use Bcrypt?
Unlike MD5/SHA which are fast (bad for passwords), bcrypt is intentionally slow. This makes brute-force attacks impractical. A cost of 10 means 2^10 (1,024) iterations, taking ~100ms to hash - negligible for login but devastating for attackers trying billions of passwords.
Security Best Practices
Use a cost of 10-12 for most applications. Cost 10 is the current minimum recommended. Never use MD5 or SHA-1 for passwords - they're broken. Never store plaintext passwords. Always use bcrypt, Argon2, or scrypt for password hashing.