Post History

With **bcrypt,** the salt is stored **in the same _string_** as the hash. This is done so that you have everything you need to get that hash identifier if you know the password.[^pepper] Wikipedia [breaks down the format][wiki]:

> ## Description
> The input to the bcrypt function is the password string (up to 72 bytes), a numeric cost, and a 16-byte (128-bit) salt value. The salt is typically a random value. The bcrypt function uses these inputs to compute a 24-byte (192-bit) hash. The final output of the bcrypt function is a string of the form:
>
> ```none
> $2<a/b/x/y>$[cost]$[22 character salt][31 character hash]
> ```
>
> For example, with input password `abc123xyz`, cost `12`, and a random salt, the output of bcrypt is the string
>
> ```none
> $2a$12$R9h/cIPz0gi.URNNX3kh2OPST9/PgBkqquzi.Ss7KIUgO2t0jWMUW
> \__/\_/\____________________/\_____________________________/
> Alg Cost      Salt                        Hash
> ```
>
> Where:
> 
> - `$2a$`: The hash algorithm identifier (bcrypt)
> - `12`: Input cost (2<sup>12</sup> i.e. 4096 rounds)
> - `R9h/cIPz0gi.URNNX3kh2O`: A base-64 encoding of the input salt
> - `PST9/PgBkqquzi.Ss7KIUgO2t0jWMUW`: A base-64 encoding of the first 23 bytes of the computed 24 byte hash
>
> The base-64 encoding in bcrypt uses the table `./ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789`, which differs from [RFC 4648][] Base64 encoding.

[^pepper]: Or password + pepper, if you do that.

[wiki]: https://en.wikipedia.org/wiki/Bcrypt#Description
[rfc 4648]: https://datatracker.ietf.org/doc/html/rfc4648