Hashing runs server-side in real apps. Use this table to pick a cost factor; times are approximate on modern hardware.
| Cost | ~Time | Note |
|---|---|---|
| 8 | ~40ms | Fast, weak for production |
| 10 | ~150ms | Common default |
| 12 | ~600ms | Recommended for interactive login |
| 14 | ~2.5s | High security, UX cost |