2

I'm making an app and am using bcrypt to encrypt passwords.

I've no prior knowledge about bcrypt and still don't know much, I know it supposed to be a secure cpu-intensive encryption.

After implementing it yesterday I noticed my sign up's becoming extreemeelyyy slow, taking about 5-10 seconds to complete. I'd thought it was just my slow computer (running the server) however after inserting a few break points on the server, I noticed it was stopping while hashing the password.

I tuned down the rounds from 15 to 1, and everything started working smoothly.

I also checked the database to see if maybe the password was the same/similar to the input password, it seem's just as random - then again I'm a human and not a brute forcing bot.

My question is, 15 rounds isn't going to cut it unless my computer really is just super slow, and the average server can hash 15 rounds in less than 10 seconds, and 1 is supposedly not secure at all, what is the best amount of rounds to hash?

I'm using bcryptjs which may not be helping with the speeds - being javascript.

Improve this question
7
  • 6
    1 is pretty garbage. You'll be safe with 10-12.
    – d0nut
    Oct 10, 2016 at 5:11
  • 1
    Slowing is the point. Number depends on risk, resources (server and app device) and application: Free game? Password manager? Store with 1-click purchase? Slow one time sign-up is much more acceptable than slow sign-in, but both are preferable to a breach. How secure is your password (user, salt, hash) file? Really?
    – BillR
    Oct 10, 2016 at 6:38
  • Are you running both sides on your (single) computer during development?
    – BillR
    Oct 10, 2016 at 6:46
  • @BillR Yes, is that bad?
    – Tobiq
    Oct 10, 2016 at 7:39
  • Similar question & answer here: security.stackexchange.com/questions/16318/… Short answer: make it as slow as your users can tolerate (probably 0.5 - 1 second).
    – PwdRsch
    Oct 10, 2016 at 17:58

1 Answer 1

Reset to default
5

Do you mean 6 rounds, or cost 6? Because cost 6 is 2^6 = 64 rounds.

Nowadays cost 10-12 is considered the minimum. However you need to look the maximum your hardware can handle.

The process of hashing should take approximetaly one second.

Improve this answer
1
  • I meant 1 cost as in 2^1 =2
    – Tobiq
    Oct 10, 2016 at 7:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .