I'm wondering if it's possible to increase the work factor of an already encrypted bcrypt password.

e.g. I have a password that was encrypted with a work factor of 5, is it possible to increase the work factor to 6 without knowing the original password?

If not, it seems to me to defeat the entire point of bcrypt, since old passwords become less and less secure


Usually the authentication work as follow:

  1. The user enters the password
  2. The password is passed to a password verification function such as password_verify($enteredPassword, $storedHash) in PHP
  3. The function generates the appropriate rounds of the configured hash function (take it from the hash value itself) and compare it with the stored hash in the DB.
  4. If both are equal, the authentication is successful.

The only thing you need to do is take the $enteredPassword and generate the hash through the new work factor procedure and store the new hash value in the DB.

Another option is to just prompt the user to update his/her password after they are logged in to the application.

  • If you're using PHP or another language with a similar password API, there should be a password_needs_rehash() function/method available that can be fed the algo and cost (in PHP, typically as PASSWORD_DEFAULT, which will change with the version, or, alternatively, as an array of values). Since using a KDF is slow (the cost value chosen should be the highest you can afford without unduly compromising performance) and you need to hash to verify the password, you don't want to perform a second hash if you don't have to. – Stan Rogers Nov 25 '14 at 20:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.