Notes on password hashing
The things that come up once you have picked a hashing function and have to live with it. Written while building the tools on this site.
8 articles · 6,336 words
15 September 2026 · 4 min read
Is Bcrypt Still Secure?
Bcrypt is from 1999 and remains a reasonable choice today. What has changed since, where it is genuinely behind Argon2id, and why age is the wrong thing to worry about.
bcryptsecurityargon2
25 August 2026 · 3 min read
Hashing, Encryption and Encoding Are Not the Same Thing
Base64 is not encryption, encryption is not hashing, and passwords need exactly one of the three. How to tell them apart, and the specific failure each mix-up produces.
hashingencryptionbasics
6 August 2026 · 4 min read
Bcrypt Salt Rounds, and Where the Salt Actually Lives
Bcrypt makes its own salt and stores it inside the hash, which is why the same password never hashes the same way twice. What rounds counts, and why there is no salt column.
bcryptsaltrounds
9 July 2026 · 3 min read
Moving From Bcrypt to Argon2 Without a Password Reset
Three ways to change password hashing function on a live database, what each one costs, and why forcing every user to reset is the option to avoid.
bcryptargon2migration
11 June 2026 · 4 min read
Bcrypt vs Argon2 vs Scrypt vs PBKDF2
What separates the four password hashing functions in practice, which one to pick for a new project, and why switching an existing one is rarely the best use of your time.
bcryptargon2scryptpbkdf2
26 May 2026 · 3 min read
What $2a, $2b, $2x and $2y Mean in a Bcrypt Hash
The version prefix in a bcrypt hash records which implementation quirk it was made under. Here is what each one means and when the difference matters.
bcryptcompatibilityphp
30 April 2026 · 5 min read
Bcrypt Stops Reading After 72 Bytes
Bcrypt never reads past the 72nd byte of a password, and most libraries discard the rest in silence. Here is where that bites, why pre-hashing with SHA-256 has its own trap, and what to do.
bcryptlimitspasswords
16 April 2026 · 3 min read
Which Bcrypt Cost Factor Should You Use in 2026?
Cost 12 is the answer for most web applications. Here is how to check that against your own hardware, and what actually goes wrong at the low and high ends.
bcryptcost factorperformance