Hacker News new | ask | show | jobs
by nneonneo 1431 days ago
Nitpick: that’s bcrypt, not Blowfish. Blowfish is an encryption algorithm; bcrypt is a password hashing algorithm based on Blowfish, but designed to be significantly slower.
1 comments

Also, bcrypt comes with a work factor that works on a log scale -- a work factor of 6 is 2^6 (64) rounds, and 6 is considered far too out of date these days. The default in hashcat is (IIRC) a work factor of 5 (2^5, 32 rounds).

If you're using 14 or higher, which is usually the recommendation thrown around these days, that 100k number will look more like single or double digits.