Key Features of Bcrypt
How Bcrypt Works
Bcrypt vs Argon2
While bcrypt is widely used and secure, modern applications increasingly adopt Argon2id, which offers better resistance against GPU and ASIC attacks. For new applications, OWASP recommends Argon2id as the preferred password hashing algorithm. Try our Argon2 Password Hash Generator for modern password security.
| Algorithm | Strength | GPU Resistance | Recommended For |
|---|---|---|---|
| Bcrypt | Strong | Moderate | Existing systems |
| Argon2id | Very Strong | High | New applications |
Advantages
- Brute-Force Resistant - slow hashing and salting make dictionary attacks impractical
- Adjustable Work Factor - scale security as hardware improves without changing your code
- Widely Trusted - battle-tested across millions of production systems for decades
Limitations
- Intentionally Slow - can impact performance under high-volume authentication scenarios
- 72-Byte Limit - generation rejects passwords longer than 72 UTF-8 bytes. Verification uses the first 72 bytes.
- No Memory Hardness - unlike Argon2id, bcrypt does not resist memory-efficient GPU attacks as effectively
Python Example
Here's a basic example of how bcrypt is used in code:
# Existing Python example: separate library, cost 12
import bcrypt
password = b"supersecret"
hashed = bcrypt.hashpw(password, bcrypt.gensalt(rounds=12))
if bcrypt.checkpw(password, hashed):
print("Password match!")
else:
print("Password does not match.")
Python bcrypt defaults to $2b$, which this server supports natively alongside $2a$ and $2y$.
Usage Guide
- Enter any plain text in the Generate panel and choose a salt round (12 is recommended). Click Generate Hash to produce the bcrypt hash.
- The salt is random - the same password produces a different hash each time. This is expected and correct behavior.
- To verify a password, paste the stored bcrypt hash and the candidate plain text in the Verify panel and click Match.
-
This tool natively supports
$2a$,$2b$, and$2y$. Generation defaults to$2b$at cost 12; verification automatically detects both from the hash. - For migrating to newer rounds, re-hash the user's password on next login using the updated cost factor - no need to force a password reset.
Frequently Asked Questions
What is bcrypt used for?
Bcrypt is a password hashing algorithm designed for secure password storage. It incorporates automatic salting and an adjustable cost factor to resist brute-force and rainbow table attacks. It is not suitable for encrypting data - only for one-way password hashing.
Is bcrypt still secure in 2026?
Yes, bcrypt remains secure when used with an appropriate cost factor (12 or higher). However, Argon2id is OWASP's current recommendation for new applications because it offers memory-hard resistance against GPU-based attacks.
What bcrypt cost factor should I use?
A cost factor of 12 is recommended for most modern systems - actual execution time depends on the hardware and load. High-security systems may use 13 or 14, as long as server response times stay within user expectations. Benchmark on your own hardware to choose wisely.
Can bcrypt hashes be reversed or decrypted?
No. Bcrypt is a one-way function - hashes cannot be reversed to retrieve the original password. Verification works by re-hashing the candidate password with the stored salt and comparing the result.
What is the difference between $2a$ and $2y$ bcrypt hashes?
$2a$ is the original bcrypt prefix; $2y$ was introduced to fix a bug in PHP's implementation. This server supports $2a$, $2b$, and $2y$ natively. Generation defaults to $2b$ with cost 12; verification automatically reads the prefix and cost from the supplied hash.
Does bcrypt have a password length limit?
Bcrypt has a 72-byte limit. Generation rejects longer passwords. Verification uses the first 72 bytes for compatibility with existing hashes. This tool does not pre-hash passwords. Changing to a pre-hashing scheme changes compatibility and requires a carefully designed migration.
❤️ Liked this tool?
If it saved you time, consider buying me a coffee to support future improvements.