Is BCRYPT easy do decrypt?

Question

I know that bcrypt doesn't encrypt, but how easy would it be to get the password from a stored bcrypt hash?

I wanna split my question about bcrypt into 2:

1. I read over here that bcrypt generates random salts for every hashing it does. How can 2 different "hashing-actions" with the same number of rounds and the same password have the same output if bcrypt generates a random salt for every time you hash something?

2. BCRYPT saves the output hash, the salt and the number of rounds with the kind of algorithm version. The output would be something like this:

$2a$10$vI8aWBnW3fID.ZQ4/zo1G.q1lRps.9cGLcZEiGDMVr5yUP1KUOYTa

You basically have everything the Algorithm needs except the input, but for that you have the output instead. Wouldn't that make it pretty easy to decrypt / un-hash the password back to its original state?

Answer 1

Bcrypt like any other salted hash method use the salt to avoid that the same password hashes to the same string. It is doing that by initially generating the salt randomly and then hashing password and salt. This can only be verified if the same salt is used when verifying. This is why the salt is saved together with the hash.

Bcrypt like any other iterated hash method can not directly be inverted, but you can try all possible passwords to see if they hash to the same result. In case of salted methods you cannot precompute this, because you have to try with the actual salt (as described above).

The idea of a iterated and salted hash is, that this bruteforcing is so slow, that it takes very long to try all possible passwords. Therefore reasonable long and complex passwords cannot quickly be bruteforced. Bcrypt is one of the (with configurable workfactor) slower and therefore better methods (but it is not invincible). This is true for all password hash methods (unless they use additional protection like encryption with a secure key 'pepper' which cannot be extracted from the authentication server).

NB: Scrypt and Argon2 are more modern variants of password hashing. And PBKDF2 has similar strength than Bcrypt but with a better compliance bullshit factor.