Salt rounds and cost in bcryptjs

How it works

1. Hash at several costs. The loop hashes the same password with 4, 6, 8, 10 and 12 rounds and measures each call with performance.now(), so you can see the time grow in your browser. [1]
2. Read the rounds back. bcrypt.getRounds(hash) returns the round count stored in each hash, which the example prints next to the timing. [1]
3. Extract the salt. bcrypt.getSalt(hash) returns the salt part of the last hash. It only slices the string. [1]

Run and edit it

It runs in your browser, in a sandboxed frame that cannot see this site; the packages load from esm.sh only after you press Run.

import bcrypt from 'bcryptjs'

const password = 's3cret-passphrase'
let lastHash = ''

console.log('rounds | time      | getRounds(hash)')
for (const rounds of [4, 6, 8, 10, 12]) {
  const t0 = performance.now()
  const hash = await bcrypt.hash(password, rounds)
  const ms = (performance.now() - t0).toFixed(0)
  console.log(`${String(rounds).padStart(6)} | ${ms.padStart(6)} ms | ${bcrypt.getRounds(hash)}`)
  lastHash = hash
}

console.log('Last hash:      ', lastHash)
console.log('getSalt(hash):  ', bcrypt.getSalt(lastHash))
console.log('Still matches?  ', await bcrypt.compare(password, lastHash))

Run ▶ResetCopyShareCtrl/⌘ + Enter runs

▶ Run the live exampleLoads bcryptjs from esm.sh after you press Run.

✦ Change it with AI

Change

Free for signed-in members, with a daily limit. Describe the change in plain words; the new code runs only in your browser.

Watch the milliseconds grow with each round count; add 13 to the list to see it climb further. Code written by AgentGid [1].

Checked Oct 12, 2026: it starts without errors in Chromium with bcryptjs 3.0.3. Needs WebGL.

More bcryptjs examples

Hashing and checking a password with bcryptjs Synchronous hashing in bcryptjs Checking the 72-byte limit with bcryptjs Hash progress and callbacks in bcryptjs