No. If the value of the cache key is simply true/false then someone would first login to their own account using the long password. This would result in storing

No. If the value of the cache key is simply true/false then someone would first login to their own account using the long password. This would result in storing: bcrypt(longpassword + 123456 + me@foobar.com) = bcrypt(longpassword) = hash1 -> true If they then try login as you@bar.com using same password there would be a cache lookup: bcrypt(longpassword + 1111111 + you@bar.com) = bcrypt(longpassword) = hash1 -> true