bcrypt Hash

What is bcrypt?

bcrypt is a password-hashing function designed in 1999 by Niels Provos and Solar Designer (with contributions from other researchers) to address the limitations of earlier hash functions like MD5 and SHA-1 in secure password storage. Structurally, bcrypt is a keyed hash function derived from the Blowfish cipher, incorporating a cost factor (work factor) and a randomly generated salt to mitigate brute-force attacks. The algorithm’s output is a 128-bit (16-byte) hash, but its security relies heavily on its adaptive computational overhead: the cost factor (e.g., 2¹² iterations by default) dynamically increases the time required to compute the hash, making it resistant to brute-force attempts on high-performance hardware. Its primary use-case is secure password storage, where the salted hash and cost factor are stored alongside the password to enforce computational delay during verification, thus deterring offline attacks. The format typically encodes the hash in a human-readable string (e.g., `$2a$05$...`) to include metadata like the algorithm variant, salt, and cost factor.

Despite its robustness, bcrypt is vulnerable to cracking due to its reliance on CPU-bound computations, which can be optimized by attackers using specialized hardware. Modern GPUs, FPGAs, and ASICs can parallelize bcrypt computations, drastically reducing the effective work factor and enabling large-scale cracking via tools like Hashcat or John the Ripper. Additionally, while salts mitigate rainbow table attacks, poorly implemented salts (e.g., non-unique or predictable salts) can be exploited. The algorithm’s fixed iteration count, though adjustable, remains static post-deployment, allowing attackers to precompute hashes for weak passwords. Furthermore, bcrypt’s reliance on Blowfish’s Feistel network makes it susceptible to side-channel attacks if not implemented with constant-time operations, and its collision resistance—though sufficient for password storage—does not protect against second-preimage attacks if the cost factor is too low. Finally, the increasing performance of consumer hardware (e.g., multi-core CPUs) can negate the intended computational delay, necessitating periodic rehashing with higher cost factors.

Identifying bcrypt Hashes

Identifying a hash blindly is often difficult because multiple algorithms can output strings of the exact same length. For example, a standard 32-character hexadecimal string could be MD5, NTLM, MD4, or LM. To definitively identify bcrypt, security researchers analyze the hash against a strict regular expression (regex) signature (shown above) to find structural matches.

How to Crack bcrypt

If you need to recover the plaintext password for a bcrypt hash during a penetration test or forensics investigation, you must supply the correct module ID to your cracking software. Use the exact commands provided at the top of this page to target the hash successfully.