title: BCrypt vs PBKDF2WithHmacSHA1
body: <p>In order to hash passwords securely, which algorithm should I use? <code>BCrypt</code> or <code>PBKDF2WithHmacSHA1</code>?</p>
  
  <p>Which is more secure? <code>PBKDF2WithHmacSHA1</code> is built into Java while <code>BCrypt</code> is available via <a href="http://www.mindrot.org/projects/jBCrypt/" rel="nofollow">jBCrypt</a> library (which has mostly received positive reviews).</p>
  
  <p>Also if I go with <code>BCrypt</code> should I limit my user's password entry to 55 characters only (since that is the limit of <code>BCrypt</code>)? </p>
  
  <p>It would be helpful if you are <code>Java</code> specific.<br/>
  Do note that I would go for the option that makes the passwords more secure and brute-forcing more difficult.</p>