Sorry for being such a noob, but I'm having a hard time wrapping my head around this. I am using bcrypt to encode plain text passwords into unique hashes before I store them in my database or authenticate. But the part I don't quite understand is that if someone were to gain access to my database and get the hashes, wouldn't they just be able to run them through bcrypt and turn them into plain text? Forgive my ignorance

2 Answers 2


No Bcrypt is a one way function- which means it is not computationally feasible to return the string back to the original value (read that as almost impossible). In otherwords once the plain text has been run through the function the output cannot be reversed. This is different to encryption which is two way.

Bcrypt is a type of Password Based Key Derivation Function which means its a method that is ideal for password storage compared to straight up hashing algorithms.

This page (http://preview.tinyurl.com/ya97mj9j) details more about web application password options and is aimed at beginners so may help you understand the different options and their related outputs.


in short no. Bcrypt hashing is a one way function, you can pass in data and get a hash, but you cannot (or at least should not be able to) pass in a hash value and get the original data.

Note that hashing is not to be confused with encryption, where you can restore the original data from the encrypted data.

see this Wiki article for more details.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .