bcrypt
also: bcrypt hashing, $2a$, $2b$, $2y$
bcrypt is a cryptographic hashing algorithm specifically designed for securely hashing passwords, incorporating a built-in salt and adaptive work factor to resist brute-force attacks.
bcrypt is a password hashing function based on the Blowfish cipher, created to address weaknesses in older hashing methods like MD5 and SHA1. It automatically generates and includes a salt (random data) in the hash output, preventing rainbow table attacks and ensuring identical passwords produce different hashes.
The algorithm includes a configurable cost factor (work factor) that determines how many iterations the hashing process performs. This makes bcrypt intentionally slow—taking significant CPU time—which slows down brute-force password cracking attempts. As computers become faster, administrators can increase the cost factor to maintain security.
A bcrypt hash typically looks like: $2b$12$abcdefghijklmnopqrstuvwxyz... The hash encodes the algorithm version, cost factor, salt, and final hash in a single string. Most modern applications and Linux systems use bcrypt for password storage in /etc/shadow and authentication systems like PAM.