Bcrypt – Secure Password Hashing Across Popular Programming Languages

[nampt.me (Nam Phạm)]

In today’s world of increasingly sophisticated cyberattacks, securing user passwords is no longer as simple as hashing and storing them in a database. Hash algorithms like MD5 or SHA1 were once popular, but they are no longer considered secure. This is where Bcrypt becomes the optimal choice.

---

What is Bcrypt?

Bcrypt was developed in 1999 based on the Blowfish encryption algorithm. Its strength lies in:

• Automatic salt: each password gets a unique random salt, preventing hash collisions.
• Cost factor (work factor): adjustable computational cost to slow down brute-force as hardware gets faster.
• One-way function: impossible to reverse-engineer the original password.

In other words, Bcrypt is not just a “hash” but a defense strategy against large-scale password cracking.

---

Comparison of Bcrypt with Other Algorithms

Algorithm	Features	Current Security
MD5	Fast hash, no salt	Insecure, easily brute-forced
SHA1	Fast, simple	Insecure, broken
SHA256	Stronger than SHA1, still fast	Better, but vulnerable without salt + key stretching
PBKDF2	Configurable iterations	Secure, widely used
Argon2	Modern, resistant to GPU/ASIC	Very secure, often compared with Bcrypt
Bcrypt	Salt, cost factor, brute-force resistant	Secure, most widely used today

Need quick password hashing? Use a bcrypt password generator.
Try it: Bcrypt Password Generator

---

Bcrypt in Popular Programming Languages

1. PHP (Laravel & Native)

Laravel has built-in Bcrypt support via the bcrypt() helper:

// Hash password
$hash = bcrypt('my-password');

// Verify password
if (Hash::check('my-password', $hash)) {
    echo "Valid password!";
}

With plain PHP:

$hash = password_hash("my-password", PASSWORD_BCRYPT);
if (password_verify("my-password", $hash)) {
    echo "Password is valid";
}

Test quickly here: bcrypt laravel generator

---

2. Node.js

Using the bcrypt library:

const bcrypt = require('bcrypt');

const password = "my-password";
const saltRounds = 10;

bcrypt.hash(password, saltRounds, function(err, hash) {
    console.log(hash);

    bcrypt.compare(password, hash, function(err, result) {
        console.log(result); // true
    });
});

---

3. Python

With the bcrypt library:

import bcrypt

password = b"my-password"
hashed = bcrypt.hashpw(password, bcrypt.gensalt())

print(hashed)

if bcrypt.checkpw(password, hashed):
    print("Password is valid")

---

4. Java

Using BCrypt from Spring Security:

import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

public class Main {
    public static void main(String[] args) {
        BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();
        String rawPassword = "my-password";
        String encoded = encoder.encode(rawPassword);

        System.out.println(encoded);
        System.out.println(encoder.matches(rawPassword, encoded));
    }
}

---

When Should You Use Bcrypt?

• When storing user passwords in a database.
• When developing web applications that require secure authentication.
• When upgrading from legacy systems using MD5 or SHA1.
• When you need a balance of security and ease of use.

---

Conclusion

Bcrypt has become the gold standard for password hashing in modern development. With built-in salting, cost factor, and multi-language support, it is trusted across the industry.

[Joe (Schwarz)]

You should mention some of the problems with Bcrypt. For example, a 256-character password with Bcrypt is truncated (shortened) to 72 bytes by most Bcrypt implementations.

What is key stretching? It’s a method for making a short password longer.