PHP's default BCrypt cost for %password_hash()% is unchanged since the addition of the password hashing API in PHP 5.5 which was 11 years ago. The current cost is %10% Increasing the cost by one, doubles the time New cost in PHP 8.4: %12% (~less than 330ms per hash)