A Ruby binding for the OpenBSD bcrypt() password hashing algorithm to securely store user passwords.
bcrypt-ruby is a Ruby binding for the OpenBSD bcrypt() password hashing algorithm that enables secure storage of user passwords in Ruby applications. It solves the critical security problem of protecting passwords in databases by making password cracking computationally expensive through adaptive hashing. The library automatically handles salt generation and provides adjustable cost factors to maintain security as hardware improves.
Ruby and Rails developers building applications that require secure user authentication and password storage. This includes web developers, security-conscious application builders, and anyone implementing user management systems in Ruby.
Developers choose bcrypt-ruby because it implements the industry-standard bcrypt algorithm specifically designed for password protection, provides automatic salt handling to prevent rainbow table attacks, and offers adjustable cost factors to future-proof security. It's the default password hashing implementation in Rails and is battle-tested in production environments.
bcrypt-ruby is a Ruby binding for the OpenBSD bcrypt() password hashing algorithm, allowing you to easily store a secure hash of your users' passwords.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Implements the bcrypt algorithm specifically designed for password protection, making password cracking computationally expensive and resistant to rainbow table attacks.
Allows developers to increase the work factor over time to maintain security as hardware improves, with a default cost of 12 that can be customized.
Handles salt generation and storage transparently, eliminating common implementation errors and ensuring each hash is unique.
Integrates directly with Rails through ActiveModel::SecurePassword, making it easy for developers to add secure password hashing to their applications.
Bcrypt is intentionally slow to resist brute-force attacks, which can increase server load and response times, especially in stateless authentication scenarios, as noted in the README.
Only supports the bcrypt algorithm, missing newer options like Argon2 that might offer better security properties in some contexts, limiting flexibility.
Requires compilation of native extensions on some platforms, which can complicate installation and deployment compared to pure-Ruby solutions.