Why You Can't Just SHA-256 a Password (and What bcrypt Actually Does)
Fast hash functions are the wrong tool for passwords. bcrypt is deliberately slow and salted — here's why that matters.
Speed is the enemy
SHA-256 can hash billions of inputs per second on commodity GPUs — great for checksums, terrible for passwords. If an attacker steals your password hashes, a fast hash function lets them brute-force weak passwords in hours.
bcrypt (and argon2, scrypt) are deliberately slow and tunable. A 'cost factor' controls how many rounds of internal hashing run, so you can keep raising the cost as hardware gets faster without changing your database schema.
Salting isn't optional
bcrypt bakes a random salt into every hash automatically, so two users with the same password get completely different stored hashes. Without a salt, attackers can precompute rainbow tables once and reuse them against every user in every breach.
- Never hash passwords with SHA-256/MD5/SHA-1 directly, salted or not
- bcrypt's cost factor should be tuned so hashing takes ~200-300ms on your server
- argon2id is the newer recommendation if your stack supports it
- Rehash on login if you bump the cost factor later — no migration needed
Try it on code.live
code.live's bcrypt generator lets you hash a test password and verify it against a hash, useful for debugging an auth flow without spinning up a full backend.
Key takeaways
- Apply one concrete change from this post before collecting more reading.
- Prefer browser-side tools when the work involves secrets, tokens, or PII.
- Document the why next to the how so the next reviewer inherits context.
FAQ
- Who is this guide on security for?
- Working developers who need a practical take on why you can't just sha-256 a password (and what bcrypt actually does) — not a marketing overview. Skim the sections, apply one tip, then come back when you hit an edge case.
- Do I need an account to use the related tools?
- No. code.live tools run in your browser with no signup. Nothing you paste is uploaded to a server for the client-side utilities linked from this post.
- How often is this article updated?
- This post was published August 15, 2026. Fundamentals stay stable; check linked tool pages and official docs when version-specific behavior matters.