SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/tech-bcrypt-work-factor

What does bcrypt's work factor control?

It controls the computational cost of each password hash.

Start playing free

  1. The maximum password length
  2. The length of the salt
  3. The cost of each hash ✔

Why: A larger work factor makes each guess slower and more expensive, including an attacker's guesses. It must remain low enough that legitimate verification performs acceptably.

Huh, didn't know that: OWASP recommends bcrypt mainly for legacy systems where Argon2 and scrypt are unavailable.

The dad joke
bcrypt asked for a raise because its work factor increased.
Like this card?
Play the game

References

Answer: The cost of each hash. A larger work factor makes each guess slower and more expensive, including an attacker's guesses. It must remain low enough that legitimate verification performs acceptably.

  1. OWASP Password Storage Cheat Sheet cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html
    The work factor should be as large as verification server performance will allow, with a minimum of 10.
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyWhy is a unique salt added before hashing a password?Security & PrivacyWhich three goals form the CIA triad?Security & PrivacyWhich password property most directly increases resistance to guessing?

That's stuff everyone should know.