Turn a bcrypt cost factor into hash time, server throughput and offline crack time, benchmarked against OWASP guidance.
bcrypt's cost parameter is a base-2 logarithm, so cost 12 does four times the work of cost 10 and takes four times as long for both you and the attacker. Its 4 KB of Blowfish S-box state is the reason GPUs gain far less against bcrypt than against PBKDF2. Cost has to be re-benchmarked on every hardware refresh: a value chosen in 2015 is now roughly an order of magnitude too cheap, and cost is the single knob standing between a leaked hash table and cracked passwords.
bcrypt Cost
hash time = measured time at cost 10 × 2^(cost − 10); bcrypt runs 2^cost key-setup rounds.
hash time = measured time at cost 10 × 2^(cost − 10); bcrypt runs 2^cost key-setup rounds. bcrypt's cost parameter is a base-2 logarithm, so cost 12 does four times the work of cost 10 and takes four times as long for both you and the attacker. Its 4 KB of Blowfish S-box state is the reason GPUs gain far less against bcrypt than against PBKDF2.
Cost has to be re-benchmarked on every hardware refresh: a value chosen in 2015 is now roughly an order of magnitude too cheap, and cost is the single knob standing between a leaked hash table and cracked passwords.
This calculator takes 4 inputs: bcrypt cost factor, Measured hash time at cost 10, Attacker rig hashes per second at cost 10, Password entropy. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Pick the highest cost whose hash time your login path can absorb — commonly 50–250 ms, which lands on cost 12 or 13 on current server CPUs. Re-measure yearly and raise it when hardware gets faster.
Yes. Most implementations use only the first 72 bytes, so a passphrase longer than that gains no extra entropy. Pre-hash with SHA-256 and Base64-encode before bcrypt if you must support longer inputs.