Blowfish is a symmetric-key block cipher designed by Bruce Schneier in 1993 as a fast, free alternative to DES. It encrypts data in 64-bit blocks using a variable key length of 32 to 448 bits. Blowfish is unpatented and still cryptographically sound, but its small 64-bit block makes it unsuitable for large modern data volumes, so newer ciphers are preferred.
Blowfish is a symmetric-key block cipher created by Bruce Schneier in 1993 as a fast, unpatented alternative to DES. It encrypts data in 64-bit blocks with a variable key length of 32 to 448 bits. The core algorithm has never been broken, but its small 64-bit block exposes it to collision attacks on large data volumes, so today it is used mainly in legacy systems and in bcrypt password hashing.
Key Takeaways
- Blowfish is a symmetric-key block cipher designed by Bruce Schneier in 1993, with a 64-bit block and a 32 to 448-bit variable key.
- It is unpatented, license-free, fast, and was a popular free replacement for DES.
- The full cipher has never been broken, but its 64-bit block makes it vulnerable to birthday-bound collision attacks (SWEET32) on large data volumes.
- Who uses it: legacy OpenVPN and SSH configurations, some file and disk encryption tools, and, most notably, bcrypt password hashing, which is derived from Blowfish and still widely used.
- Blowfish’s limitation is classical (block size), not quantum. For modern use, its successor Twofish or the standard AES is recommended.
What Is Blowfish?
Blowfish is a symmetric-key block cipher that appeared in 1993, designed by Bruce Schneier as a versatile, secure, and fast alternative to the aging Data Encryption Standard (DES). Schneier deliberately made Blowfish unpatented and freely available, and that openness drove its wide adoption across many applications and systems.
Technically, Blowfish encrypts data in 64-bit blocks using a 16-round Feistel structure, and it supports a variable key length from 32 up to 448 bits, giving flexibility between speed and strength. A distinctive feature is its key schedule: setting up a new key requires substantial precomputation (equivalent to encrypting about 4 KB of data), which slows frequent key changes but also makes brute-force key search harder. Blowfish was never selected as a standard, but it was influential enough that Schneier and colleagues later designed Twofish as its successor for the AES competition.
Who Uses Blowfish?
Blowfish saw broad use in the 1990s and 2000s, and while it has largely been superseded, it still appears in several places today:
- Password hashing (bcrypt): The most important living use. bcrypt, one of the most widely deployed password-hashing algorithms, is built directly on Blowfish’s key schedule. Countless web applications and frameworks still use bcrypt to store passwords securely, so Blowfish’s design remains in daily use even where the cipher itself is not.
- Legacy VPN and SSH: Older OpenVPN and SSH configurations offered Blowfish as a cipher option. It still exists in some legacy deployments, though modern setups default to AES.
- File and disk encryption tools: Various older or lightweight encryption utilities and password managers used Blowfish for local file or database encryption, valued for being free and fast.
- Embedded and legacy systems: Its small footprint and lack of licensing made it attractive for embedded devices and older software that have not been updated.
For new systems, however, Blowfish is generally not recommended. Its designer, Bruce Schneier, has said for years that people should move to Twofish (or a modern standard like AES) instead. The reason is not a break in the algorithm itself, but its block size.
The Real Weakness: A 64-Bit Block (SWEET32)
Blowfish’s core has never been broken, but its 64-bit block size is a genuine problem for modern use. With such a small block, once you encrypt enough data under a single key, two blocks will eventually match by chance (a birthday-bound collision), and that can leak information about the plaintext. The SWEET32 attack (disclosed in 2016) demonstrated this practically against 64-bit block ciphers, showing that after roughly 32 GB of data under one key, the encryption can start to leak. Modern ciphers like AES and Twofish use 128-bit blocks, which pushes that threshold astronomically higher. This is why Blowfish is unsuitable for encrypting large volumes of data or long-lived connections, and why it is considered legacy today.
Advantages and Disadvantages of Blowfish
| Advantages | Disadvantages |
| Fast, and faster than DES | 64-bit block: vulnerable to birthday/collision attacks (SWEET32) on large data |
| Unpatented, license-free, public domain | Slow key setup (about 4 KB of precomputation per new key) |
| Variable key length (32 to 448 bits) | Frequent key changes are costly due to key schedule |
| Simple, compact, well studied | Superseded by Twofish and AES for modern use |
The advantages explain Blowfish’s historical popularity: it was fast, free, and flexible. The disadvantages, above all the 64-bit block, are why it has been retired from most new designs in favor of 128-bit block ciphers.
Is Blowfish Secure in 2026? And What About Quantum?
Blowfish’s core algorithm remains cryptographically sound in 2026, in the sense that no practical attack breaks the cipher itself. However, it should not be used for new systems that handle significant data, because the 64-bit block makes it vulnerable to collision attacks like SWEET32. For anything modern, use AES or Twofish, which have 128-bit blocks. Note that this is a classical limitation, not a quantum one. On the quantum question specifically: as a symmetric cipher, Blowfish is not threatened by Shor’s algorithm, which breaks public-key algorithms like RSA and ECC. The only relevant quantum attack is Grover’s algorithm, which halves effective key strength, and Blowfish’s large key range can absorb that. So quantum computing is not Blowfish’s problem; its block size is. The post-quantum transition (where NIST finalized ML-KEM, ML-DSA, and SLH-DSA in 2024, and plans to retire RSA and ECC by 2030 to 2035) is about public-key cryptography, while the reason to retire Blowfish has nothing to do with quantum at all.
How Encryption Consulting Helps
Legacy ciphers like Blowfish often linger in systems long after they should be replaced. Encryption Consulting’s Encryption Advisory Services inventory the algorithms and key sizes in use across your environment, flag outdated or risky choices like 64-bit block ciphers, and design a migration to strong, standards-aligned cryptography (AES, Twofish, and modern key management), aligned to NIST and FIPS 140-3, including planning for the post-quantum transition of your public-key cryptography. Backed by ISO/IEC 27001:2022 and SOC 2 certified practices.
Frequently Asked Questions
What is Blowfish in security?
Blowfish is a symmetric-key block cipher designed by Bruce Schneier in 1993 as a fast, free alternative to DES. It encrypts data in 64-bit blocks using a variable key length of 32 to 448 bits, built on a 16-round Feistel structure. Blowfish is unpatented and in the public domain, which made it popular across many applications. Its core has never been broken, but its small 64-bit block limits its safe use with large data volumes today.
Who uses Blowfish?
Blowfish is used most notably through bcrypt, a widely deployed password-hashing algorithm derived from Blowfish’s key schedule, which countless web applications still use to store passwords. Beyond that, Blowfish appears in legacy OpenVPN and SSH configurations, older file and disk encryption tools and password managers, and embedded or legacy systems that value its speed and free licensing. For new systems, though, its designer recommends Twofish or AES instead.
Is Blowfish secure?
The Blowfish algorithm itself has never been practically broken, so in that narrow sense it is still secure. However, it is not recommended for modern use because its 64-bit block size makes it vulnerable to birthday-bound collision attacks, demonstrated by the SWEET32 attack in 2016, once a large amount of data is encrypted under one key. Modern ciphers like AES and Twofish use 128-bit blocks and do not have this limitation, so they are preferred.
What is the difference between Blowfish and Twofish?
Twofish is the successor to Blowfish, designed by Bruce Schneier and his team for the AES competition. Both are symmetric block ciphers by the same designer, but Twofish uses a larger 128-bit block (versus Blowfish’s 64-bit), which avoids the collision weakness that limits Blowfish on large data. Twofish supports 128, 192, and 256-bit keys and was an AES finalist. In short, Twofish was built to fix Blowfish’s shortcomings and is the better choice for modern use.
Why is Blowfish’s 64-bit block a problem?
A 64-bit block means there are a limited number of possible block values, so once enough data is encrypted under a single key, two ciphertext blocks will eventually collide by chance. These birthday-bound collisions can leak information about the plaintext. The SWEET32 attack showed this is practical against 64-bit block ciphers after roughly 32 GB of data under one key. Modern 128-bit block ciphers like AES and Twofish raise that threshold so high that it is not a concern, which is why they are preferred.
Is Blowfish quantum-safe?
As a symmetric cipher, Blowfish is not threatened by Shor’s algorithm, which breaks public-key algorithms like RSA and ECC but does not apply to symmetric encryption. The only relevant quantum attack, Grover’s algorithm, merely halves effective key strength, which Blowfish’s large key range can absorb. So quantum computing is not the reason to avoid Blowfish; its 64-bit block size is. The urgent post-quantum migration concerns public-key cryptography, not symmetric ciphers like Blowfish.
Modernize Your Encryption
If Blowfish or other legacy ciphers are still in use in your environment, it is worth knowing where and planning a move to modern algorithms. Explore Encryption Consulting’s Encryption Advisory Services to inventory your cryptography and build a roadmap to strong, quantum-ready encryption.