Cost factor

The cost factor — also called the work factor — is the number that controls how expensive a single password-hashing operation is. bcrypt exposes it as a round count (its cost 12 means 2¹² = 4,096 internal rounds), and sha512crypt exposes it as an explicit rounds=N parameter. Raising the cost factor makes legitimate logins take a little longer, but it makes every single guess in a brute-force or dictionary attack take proportionally longer too.

That trade-off is the whole point of a slow hash: a cost factor is only useful because an attacker pays it on every candidate password they test, while a real user pays it once per login. Doubling the cost factor roughly doubles both numbers, which is why it needs periodic increases as hardware gets faster — a cost factor chosen in 2015 no longer slows down a modern GPU the way it once did.

A cost factor is not the same thing as a salt: a salt defeats precomputation and stops identical passwords from matching, while the cost factor is what actually makes each guess slow. See why fast hashes are dangerous for what happens when a stored password has no cost factor at all, and Argon2 vs bcrypt vs scrypt for how to pick one.