bcrypt Cost Factor Runtime

Estimate how long a bcrypt hash takes at a given cost factor and how it scales when you bump the work factor.

Inputt(cost) = t₀ · 2^(cost − cost₀) , rounds = 2^cost

Measured cost factorMeasured hash time at that cost (ms)Target cost factorLogin latency budget (ms) — optional

Your recent runs (stored only in your browser)

No calculations yet — results land here so you can compare runs.

The engineering

bcrypt's cost (work) factor is an exponent: each increment doubles the number of Blowfish key-setup rounds, so hash time doubles too. Measure the actual time on your production hardware at one known cost, and this card projects the runtime — and throughput — at any other cost.

The design goal is to keep verification slow enough to throttle offline attackers while staying under your login latency budget. A common target is roughly 100–250 ms per hash; pick the highest cost that clears that. Re-benchmark whenever you change CPUs — the same cost that took 65 ms in 2015 may take 15 ms today, which is exactly why the factor is tunable.

Where this math comes from

Niels Provos and David Mazières introduced bcrypt at USENIX in 1999, built on Bruce Schneier's Blowfish cipher. Their insight was the 'eksblowfish' expensive key schedule: an adjustable cost parameter that forces 2^cost expensive setup rounds before any hashing, so the algorithm could be made deliberately slower as hardware got faster — a defense that scales with Moore's law instead of falling behind it.

That tunability is bcrypt's whole point. Where a plain hash gets cheaper to crack every year, bcrypt operators simply raise the cost factor by one to cancel each doubling of attacker compute. Decades later it remains a default password hash in OpenBSD, PHP, and countless web frameworks, though newer memory-hard designs like scrypt and Argon2 now target GPU and ASIC attacks bcrypt's CPU-bound rounds don't fully resist.

1993Bruce SchneierPublishes the Blowfish cipher that bcrypt's key schedule is built on.
1999Niels Provos & David MazièresPresent bcrypt with its adjustable expensive-key-setup cost factor at USENIX.
2009Colin PercivalIntroduces scrypt, adding memory-hardness that pure-CPU bcrypt lacks.
2015Password Hashing CompetitionSelects Argon2 as the recommended modern successor for new systems.

See the full timeline of the math behind every calculator →

Runs entirely in your browser — nothing you enter leaves this page. Your recent runs are stored only on your device.