RFC: Increasing the default BCrypt cost

Project Governance
Author
Target
8.4
PHP's default BCrypt cost for password_hash is unchanged since the addition of the password hashing API in PHP 5.5 which was 11 years ago.

Increase the default BCrypt cost?

Overall Results

Yes
No
Yes
25 Votes (100%)
No
0 Votes (0%)

Voting Timeline

Dates based on UTC

Voting Breakdown

Increase the default BCrypt cost to?

Overall Results

11 (less than 160ms per hash)
12 (less than 330ms per hash)
11 (less than 160ms per hash)
12 Votes (46%)
12 (less than 330ms per hash)
14 Votes (54%)

Voting Timeline

Dates based on UTC

Voting Breakdown