Is Bcrypt used for Hashing or Encryption? A bit of confusion

It is both :)

Most of the time when people mention BCrypt, they are talking about the adaptive hash algorithm, but it is also the name of an unrelated file encryption utility.

Both are based on the Blowfish cipher.


Bcrypt encryption software uses the Blowfish algorithm designed by Bruce Schneier in 1993. [1]

The bcrypt hash function is just that, a hash function. It does not perform encryption, it hashes. It's based on the Blowfish cipher, and is considered a good thing because you can make it slower over time.

From Wikipedia:

This is not cryptographically significantly stronger than the standard Blowfish key schedule, but the number of rekeying rounds is configurable; the hashing process can therefore be made arbitrarily slow, which helps deter brute-force attacks upon the hash or salt.

In regards to storing passwords on your site, you should be encrypting passwords before you hash them.

Only after you encrypt them with some encryption algorithm (e.g. Blowfish, Rijndael / AES) should you use bcrypt to hash the ciphered passwords, and store the password hashes.

For more details on implementing password security, see the top answer to this question.