title: How to continuously keep the number of bcrypt rounds relevant to the current year's hardware?
body: <p>I saw a recommendation that the number of rounds be set to <code>($currentYear - 2000)</code> to account for Moore's law, so that 2013 would be <code>13</code> rounds and therefore <code>2^13</code> total iterations.  Of course, you need to take into account your own hardware to ensure it doesn't take too long (I saw <code>1 second</code> recommended as "safe" for checking passwords/hashes, and 13 rounds falls around that mark on my current hardware).</p>
  
  <p>Does that sound reasonable for a social networking type of site?  Or would I be setting myself up for very slow password checking in the future by using <code>($currentYear - 2000)</code>?  </p>
  
  <p>Also, how do you deal with changing the number of rounds from one year to the next?  Won't changing the number of rounds change the hashes, therefore not allowing you to check hashes from 2013 in 2014 since the check would use an extra round?  Would you have to re-calculate every single hash each year, or how would it work exactly?</p>