2

I'm making an app and am using bcrypt to encrypt passwords.

I've no prior knowledge about bcrypt and still don't know much, I know it supposed to be a secure cpu-intensive encryption.

After implementing it yesterday I noticed my sign up's becoming extreemeelyyy slow, taking about 5-10 seconds to complete. I'd thought it was just my slow computer (running the server) however after inserting a few break points on the server, I noticed it was stopping while hashing the password.

I tuned down the rounds from 15 to 1, and everything started working smoothly.

I also checked the database to see if maybe the password was the same/similar to the input password, it seem's just as random - then again I'm a human and not a brute forcing bot.

My question is, 15 rounds isn't going to cut it unless my computer really is just super slow, and the average server can hash 15 rounds in less than 10 seconds, and 1 is supposedly not secure at all, what is the best amount of rounds to hash?

I'm using bcryptjs which may not be helping with the speeds - being javascript.

  • 5
    1 is pretty garbage. You'll be safe with 10-12. – d0nut Oct 10 '16 at 5:11
  • 1
    Slowing is the point. Number depends on risk, resources (server and app device) and application: Free game? Password manager? Store with 1-click purchase? Slow one time sign-up is much more acceptable than slow sign-in, but both are preferable to a breach. How secure is your password (user, salt, hash) file? Really? – BillR Oct 10 '16 at 6:38
  • Are you running both sides on your (single) computer during development? – BillR Oct 10 '16 at 6:46
  • @BillR Yes, is that bad? – Tobiq Oct 10 '16 at 7:39
  • Similar question & answer here: security.stackexchange.com/questions/16318/… Short answer: make it as slow as your users can tolerate (probably 0.5 - 1 second). – PwdRsch Oct 10 '16 at 17:58
3

Do you mean 6 rounds, or cost 6? Because cost 6 is 2^6 = 64 rounds.

Nowadays cost 10-12 is considered the minimum. However you need to look the maximum your hardware can handle.

The process of hashing should take approximetaly one second.

  • I meant 1 cost as in 2^1 =2 – Tobiq Oct 10 '16 at 7:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.