title: Why is BCrypt more secure than just storing a salt and an encrypted password in the database?
body: <p>I am reading this article and it seems like BCrypt is:</p>
  
  <ul>
  <li>slow to compute a hash from a password (a good thing)</li>
  <li>doesn't store a salt in the database but just in the password directly</li>
  <li>uses a log_rounds parameter which says how many times to compute the internal hash function.</li>
  </ul>
  
  <p>So the hash would look something like this:</p>
  
  <pre><code>hashed = hashpw(plaintext_password, gensalt(log_rounds=13))
  print hashed
  '$2a$13$ZyprE5MRw2Q3WpNOGZWGbeG7ADUre1Q8QO.uUUtcbqloU0yvzavOm'
  </code></pre>
  
  <p>But if that's what's stored in the database, if the database gets hacked, aren't we still vulnerable? The BCrypt hash contains the salt and the encoded password and so why is this better than just storing the salt and the password in the database (The article calls it bad solution #4)?</p>
  
  <p>Is the major difference the slowness of BCrypt's hashing mechanism which makes it hard and expensive to BCrypt a long list of common passwords?</p>