bcrypt Cost Calculator
Turn a bcrypt cost factor into hash time, server throughput and offline crack time, benchmarked against OWASP guidance.
About bcrypt Cost Calculator
bcrypt's cost parameter is a base-2 logarithm, so cost 12 does four times the work of cost 10 and takes four times as long for both you and the attacker. Its 4 KB of Blowfish S-box state is the reason GPUs gain far less against bcrypt than against PBKDF2. Cost has to be re-benchmarked on every hardware refresh: a value chosen in 2015 is now roughly an order of magnitude too cheap, and cost is the single knob standing between a leaked hash table and cracked passwords.
Formula
bcrypt Cost
hash time = measured time at cost 10 × 2^(cost − 10); bcrypt runs 2^cost key-setup rounds.
- cost
- bcrypt cost factor, a log₂ work parameter (4–31)
- 2^cost
- Expensive Blowfish key expansions per hash
- hash time
- Wall-clock cost of one hash on your hardware
Worked example
With the default values below, bcrypt Cost Calculator returns Hash Time at This Cost of 260.0. Change any input above and every figure here is recalculated in your browser.
Inputs used
- bcrypt cost factoraccepts 4–16
- 12
- Measured hash time at cost 10accepts 1–2,000 ms
- 65 ms
- Attacker rig hashes per second at cost 10minimum 100 hash/s
- 20,000 hash/s
- Password entropyaccepts 10–128 bits
- 40 bits
Results
- Hash Time at This Cost
- 260.0 ms
- Key-setup Iterations (2^cost)
- 4,096
- Server Logins per Second per Core
- 3.85
- Attacker Guesses per Second
- 5,000
- Crack Time (log₁₀ years)
- 0.5
- Assessment
- Meets the OWASP recommendation of cost ≥ 12
Step by step
- 1Values used
- 2bcrypt Cost
- 3Hash Time at This Cost= 260.0 ms
- 4Key-setup Iterations (2^cost)= 4,096
- 5Server Logins per Second per Core= 3.85
- 6Attacker Guesses per Second= 5,000
- 7Crack Time (log₁₀ years)= 0.5
- 8Assessment= Meets the OWASP recommendation of cost ≥ 12
Assumptions and limits
- The result is derived only from the 4 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax or compounding frequency into account.
- Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
How is bcrypt Cost calculated?
hash time = measured time at cost 10 × 2^(cost − 10); bcrypt runs 2^cost key-setup rounds. bcrypt's cost parameter is a base-2 logarithm, so cost 12 does four times the work of cost 10 and takes four times as long for both you and the attacker. Its 4 KB of Blowfish S-box state is the reason GPUs gain far less against bcrypt than against PBKDF2.
Why does bcrypt Cost matter?
Cost has to be re-benchmarked on every hardware refresh: a value chosen in 2015 is now roughly an order of magnitude too cheap, and cost is the single knob standing between a leaked hash table and cracked passwords.
What values do I need to enter?
This calculator takes 4 inputs: bcrypt cost factor, Measured hash time at cost 10, Attacker rig hashes per second at cost 10, Password entropy. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
What cost factor should I use?
Pick the highest cost whose hash time your login path can absorb — commonly 50–250 ms, which lands on cost 12 or 13 on current server CPUs. Re-measure yearly and raise it when hardware gets faster.
Does bcrypt truncate long passwords?
Yes. Most implementations use only the first 72 bytes, so a passphrase longer than that gains no extra entropy. Pre-hash with SHA-256 and Base64-encode before bcrypt if you must support longer inputs.