Bcrypt has held the password-storage line for twenty-five years. Here is the algorithm, the cost knob, and the four things that fail when teams wire it in.