Securing Passwords with bcrypt

About 215 milliseconds: that is how long one bcrypt hash at cost 12 took on the machine used to test this lesson. A login that takes a fifth of a second is barely noticeable to alice. For an attacker who stole the user table and wants to try a billion guesses against her stored hash, the same delay adds up to years of computing time. That slowness is deliberate, and it is the main reason to use bcrypt for passwords.

Why Passwords Are Stored as Hashes

If the server stores passwords as plain text, anyone who reads the user table can log in as every user