Skip to content

Instantly share code, notes, and snippets.

@aziraphale
Created September 4, 2012 08:04
Show Gist options
  • Select an option

  • Save aziraphale/3618304 to your computer and use it in GitHub Desktop.

Select an option

Save aziraphale/3618304 to your computer and use it in GitHub Desktop.
Bcrypt in PHP Timings
To get an idea of the ideal number of bcrypt "rounds" to use for highest security without requiring
excessive CPU time, I wrote a little PHP script to hash a 9-character password with every possible
number of rounds (from 4 to 31), timing how long it takes to perform each hash.
This test was performed on an Intel Core i5-2500 CPU @ 3.3 GHz, running Windows 7 64-bit and
PHP 5.4.0 (x86; VC9; CLI). The machine was being used for general development work at the same
time, but the script was only single-threaded and the development work wasn't particularly heavy,
so the times should be fairly accurate.
RESULTS (times in seconds):
4: 0.0013420581817627
5: 0.0025110244750977
6: 0.0048818588256836
7: 0.0094709396362305
8: 0.019078016281128
9: 0.037874937057495
10: 0.075153112411499
11: 0.15010213851929
12: 0.29720687866211
13: 0.59412312507629
14: 1.1954891681671
15: 2.4306519031525
16: 4.8433339595795
17: 9.7801411151886
18: 19.227061986923
19: 38.323782920837
20: 76.974308013916 ( 1.3 mins)
21: 156.51620221138 ( 2.6 mins)
22: 311.50990414619 ( 5.2 mins)
23: 625.07019400597 (10.4 mins)
24: 1247.1522209644 (20.8 mins)
25: 2493.5025999546 (41.6 mins)
26: 4999.0817778111 ( 1.4 HOURS)
27: 9997.7808241844 ( 2.8 HOURS)
28: 19863.30025506 ( 5.5 HOURS)
29: 39932.696026802 (11.1 HOURS)
30: [Probably 22 hours - I gave up at this point]
31: [Probably 44 hours]
And yes, the times appear to be exponential.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment