bcrypt Cost Calculator
Turn a bcrypt cost factor into hash time, server throughput and offline crack time, benchmarked against OWASP guidance.
Inputs
Work doubles with every increment — cost is a log₂ value.
Hash Time at This Cost
260.0ms
Key-setup Iterations (2^cost)
4,096
Server Logins per Second per Core
3.85
Attacker Guesses per Second
5,000
Crack Time (log₁₀ years)
0.5
Assessment
Meets the OWASP recommendation of cost ≥ 12
Step by step
Values used
bcrypt cost factor = 12; Measured hash time at cost 10 = 65 ms; Attacker rig hashes per second at cost 10 = 20,000 hash/s; Password entropy = 40 bits
bcrypt Cost
hash time = measured time at cost 10 × 2^(cost − 10); bcrypt runs 2^cost key-setup rounds.
Hash Time at This Cost
= 260.0 ms
Key-setup Iterations (2^cost)
= 4,096
Server Logins per Second per Core
= 3.85
Attacker Guesses per Second
= 5,000
Crack Time (log₁₀ years)
= 0.5
Assessment
= Meets the OWASP recommendation of cost ≥ 12
How it works
bcrypt's cost parameter is a base-2 logarithm, so cost 12 does four times the work of cost 10 and takes four times as long for both you and the attacker. Its 4 KB of Blowfish S-box state is the reason GPUs gain far less against bcrypt than against PBKDF2. Cost has to be re-benchmarked on every hardware refresh: a value chosen in 2015 is now roughly an order of magnitude too cheap, and cost is the single knob standing between a leaked hash table and cracked passwords.
Formula
bcrypt Cost
hash time = measured time at cost 10 × 2^(cost − 10); bcrypt runs 2^cost key-setup rounds.
- cost
- bcrypt cost factor, a log₂ work parameter (4–31)
- 2^cost
- Expensive Blowfish key expansions per hash
- hash time
- Wall-clock cost of one hash on your hardware
Frequently Asked Questions
How is bcrypt Cost calculated?
hash time = measured time at cost 10 × 2^(cost − 10); bcrypt runs 2^cost key-setup rounds. bcrypt's cost parameter is a base-2 logarithm, so cost 12 does four times the work of cost 10 and takes four times as long for both you and the attacker. Its 4 KB of Blowfish S-box state is the reason GPUs gain far less against bcrypt than against PBKDF2.
Why does bcrypt Cost matter?
Cost has to be re-benchmarked on every hardware refresh: a value chosen in 2015 is now roughly an order of magnitude too cheap, and cost is the single knob standing between a leaked hash table and cracked passwords.
What values do I need to enter?
This calculator takes 4 inputs: bcrypt cost factor, Measured hash time at cost 10, Attacker rig hashes per second at cost 10, Password entropy. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
What cost factor should I use?
Pick the highest cost whose hash time your login path can absorb — commonly 50–250 ms, which lands on cost 12 or 13 on current server CPUs. Re-measure yearly and raise it when hardware gets faster.
Does bcrypt truncate long passwords?
Yes. Most implementations use only the first 72 bytes, so a passphrase longer than that gains no extra entropy. Pre-hash with SHA-256 and Base64-encode before bcrypt if you must support longer inputs.