Bcrypt Work Factor Benchmark
Times one bcrypt hash per selected cost in this browser and reports elapsed milliseconds rounded to two decimals. Results vary with device and load.
About this bcrypt work factor benchmark
Times one bcrypt hash per selected cost in this browser and reports elapsed milliseconds rounded to two decimals. Results vary with device and load Runs entirely in-memory using Web Crypto primitives to keep sensitive tokens, certificates, and cryptographic keys secure from third-party interception.
Encoding & cryptographic principles
Runs one synchronous bcrypt hash per accepted cost and reports elapsed performance.now() milliseconds rounded to two decimals. These device- and load-dependent measurements are not exact or a stable benchmark.
Worked verification example
Scenario: Measure the two permitted low bcrypt costs on the current browser.
Sample input:
Processing: Run bcrypt hashSync once for each accepted cost and measure each run with performance.now.
Illustrative output:
Security parameters & input constraints
Empty, fractional, out-of-range or more than eight costs are rejected. Timings depend on this device and current load; a single synchronous run per cost is not a stable benchmark or production password policy. No password is stored or verified.
Cryptographic digests, encoded strings, and signatures generated by Bcrypt Work Factor Benchmark should be verified against target authentication systems before production use.
Client-side Web Crypto boundary
Key derivation, hashing, and encoding in Bcrypt Work Factor Benchmark execute in local memory using Web Crypto APIs without remote socket transmission.
Cryptographic specifications & RFC standards
Technical specifications and cryptographic RFC standards governing algorithms and key representations:
Bcrypt Work Factor Benchmark verification · Audit standards
How to use it
- Enter JSON with password and one to eight integer costs from 4 through 14; omitted costs use 8, 10 and 12.
- Run bcrypt hashSync once at each cost and time each run with performance.now.
- Compare the JSON timings in milliseconds and the first cost crossing 100 ms, if any.
Frequently asked questions
What does Bcrypt Benchmark time?+
It parses a JSON password and one to eight integer costs from 4 through 14, runs bcrypt hashSync for each cost, and returns milliseconds measured by performance.now.
What example can I run locally?+
The czoa-demo example with costs 4 and 5 returned two timing rows with those costs and a recommendation. The numeric milliseconds are intentionally not fixed because they depend on the running browser and machine.
How is the recommendation selected?+
It returns the first tested cost reaching 100 milliseconds; if none reaches that threshold, it returns the last tested cost. Missing costs uses 8, 10, 12; an empty or invalid costs array is rejected.
Is this a production password policy?+
No. A local timing sample does not establish server load, concurrency, rate limiting, password storage, breach resistance, hardware variation, or a suitable authentication policy.