Yes, I was able to determine that bcrypt is a one-way hash algorithm. But part of my point is that the name is ambiguous because there are multiple things using that name. Even the wikipedia entry for bcrypt is for the encryption software ( http://en.wikipedia.org/wiki/Bcrypt ), not the hashing algorithm, so I was having a hard time finding out more about the algorithm other than that there is a ruby binding for it. Thankfully, the ruby docs contain references.

Consider this codinghorror posting, http://www.codinghorror.com/blog/archives/000953.html , where Atwood confuses the reasons why third-party websites would need to obscure passwords in the first paragraph and quoted section (a third party needs the plaintext of the password in order to offer integration services (assuming things like remote keys and oauth are not provided), so storing a hash of the password is meaningless in that context).

And I only used twitter and twitter applications as an example of a ecosystem that has, up until their oauth deployment, multiple consumers of passwords for different purposes (twitter for authentication, apps for integration), as a way to point out the confusion.