Why the Default bcrypt Cost Factor 10 May No Longer Be Secure Enough

A widely circulated developer tutorial warning highlights that the bcrypt cost factor of 10, copied into countless codebases, was set as a reasonable default years ago but may now offer weaker protection against modern hardware. Bcrypt's second argument controls computational expense by roughly doubling the work required with each increment, deliberately slowing down password hashing to limit brute-force attacks. Because specialized hardware grows faster every year, a cost factor that was adequate when most tutorials were written now provides measurably less resistance to offline attacks on stolen password databases. The flaw is invisible in normal operation — logins continue working fine — but becomes critical if a database is ever compromised. Security experts recommend developers check current guidance from security-focused organizations when configuring bcrypt, rather than relying on whatever value appears in legacy code or tutorials.