Notes on password hashing
The things that come up once you have picked a hashing function and have to live with it. Written while building the tools on this site.
5 articles · 3,312 words
9 July 2026 · 3 min read
Moving From Bcrypt to Argon2 Without a Password Reset
Three ways to change password hashing function on a live database, what each one costs, and why forcing every user to reset is the option to avoid.
bcryptargon2migration
11 June 2026 · 3 min read
Bcrypt vs Argon2 vs Scrypt vs PBKDF2
What separates the four password hashing functions in practice, which one to pick for a new project, and why switching an existing one is rarely the best use of your time.
bcryptargon2scryptpbkdf2
26 May 2026 · 3 min read
What $2a, $2b, $2x and $2y Mean in a Bcrypt Hash
The version prefix in a bcrypt hash records which implementation quirk it was made under. Here is what each one means and when the difference matters.
bcryptcompatibilityphp
30 April 2026 · 3 min read
Bcrypt Stops Reading After 72 Bytes
Bcrypt silently ignores everything past the 72nd byte of a password. Here is where that bites, why pre-hashing with SHA-256 has its own trap, and what to do.
bcryptlimitspasswords
16 April 2026 · 3 min read
Which Bcrypt Cost Factor Should You Use in 2026?
Cost 12 is the answer for most web applications. Here is how to check that against your own hardware, and what actually goes wrong at the low and high ends.
bcryptcost factorperformance