The slow hash
A million password hashes have been stolen. How much does making your hash slower actually buy you?
A million password hashes have been stolen. Each guess an attacker makes costs the same work as one login costs you, if the hash is slow and salted. The panels show what one login costs you, what one stolen password costs the attacker, and what the whole table costs.
Board: Authentication →On a narrow screen the three panels stack below the dials, and the table scrolls sideways.
try this Drag The password from 8 letters or digits to the most common ones and watch every row collapse.
The two speeds were measured on one laptop core in the Authentication lesson: SHA-256 in 0.0016 ms, bcrypt at cost 10 in 50.1 ms. Every +1 of cost doubles bcrypt's work. The attacker's core counts are teaching values.
You, per login
50.1 ms
to check one password, once, when someone logs in
31,313x the work of the fast hash.
The attacker, per user
22 years
on average to find one password, at 1,996 /s guesses
The whole table
2.2 × 10^7 years
to crack all 1,000,000 stolen passwords
Salted: each of the 1,000,000 users is a separate search, and every guess costs the attacker what one login costs you.
The hash dial, swept
Every hash, for the current password and the current attacker.
| Hash | One login | Guesses | One user | Whole table |
|---|---|---|---|---|
| plain SHA-256 | 0.0016 ms | 6.3 × 10^7 /s | 6.3 h | 6.3 h |
| bcrypt, 2^8 rounds | 12.5 ms | 7,984 /s | 6 years | 5.6 × 10^6 years |
| bcrypt, 2^9 rounds | 25.1 ms | 3,992 /s | 11 years | 1.1 × 10^7 years |
| bcrypt, 2^10 rounds | 50.1 ms | 1,996 /s | 22 years | 2.2 × 10^7 years |
| bcrypt, 2^11 rounds | 100 ms | 998 /s | 45 years | 4.5 × 10^7 years |
| bcrypt, 2^12 rounds | 200 ms | 499 /s | 90 years | 9.0 × 10^7 years |
| bcrypt, 2^13 rounds | 401 ms | 250 /s | 179 years | 1.8 × 10^8 years |
| bcrypt, 2^14 rounds | 802 ms | 125 /s | 358 years | 3.6 × 10^8 years |
Same attacker. One user has one of the 10,000 most common passwords behind bcrypt at cost 14, the slowest on the dial. Another has four random words behind bcrypt at cost 8, the fastest. Whose password survives longer?
Who pays, and how often
A slow hash costs you 50.1 ms once, when someone logs in. It costs the attacker the same 50.1 ms for every guess, for every user. That asymmetry is the whole design. With the fast, unsalted hash the same password falls in 6.3 h, and the whole table in the same time, because one guess is checked against every user at once.
Each step of cost doubles both sides: your login and the attacker's search. So the cost dial buys a fixed factor, never a different league. The password dial is the one that moves whole orders of magnitude. Slide it to the most common passwords and watch every row collapse to minutes.
Limits of this model
One measured core. Both speeds come from one laptop core running JavaScript. A tuned native implementation is faster at both, so read the ratios, not the absolute times.
GPUs are left out. Graphics cards speed up SHA-256 enormously and bcrypt far less, which makes the real gap between the two hashes wider than shown here, not narrower.
Averages over a uniform search. Real attackers try likely passwords first, so a human-chosen password falls much sooner than its search space suggests. Only truly random passwords get the times in the table.