Password hashing: Argon2id, scrypt and bcrypt

A table of password records leaks. If each record is a SHA-256 of the password, one core in this lesson’s recorded run tried about a million guesses a second, so a list of ten million likely passwords took under ten seconds; with Argon2id at OWASP’s setting the same core managed about 37 a second, and the list took 75 hours for every single record.

That gap is what a password hash is for. This lesson shows why fast hashes fail, compares the four functions current guidance names, Argon2id, scrypt, bcrypt and PBKDF2, runs Argon2id against RFC 9106’s test vector, and follows one stored record from sign-up to the login that checks it.

A fast hash lets a stolen table be guessed millions of times a second

People choose passwords from a small set of likely words and patterns, so a thief with the records does not break the hash; they hash likely passwords until one matches. What protects a record then is the cost of each guess. The program measures it on one core, for a record that is a SHA-256 and for one that is Argon2id with 19 MiB of memory:

// How fast one core of this computer tries password guesses against a stolen record, when the record is a SHA-256 of
// the password and when it is Argon2id with OWASP's setting m=19456 KiB, t=2, p=1. The times change from run to run.
import { argon2Sync, createHash } from 'node:crypto';

const salt = Buffer.from('a-16-byte-salt!!'); // a lab salt; real salts come from a CSPRNG
const perSecond = (work, calls) => {
  const start = performance.now();
  for (let i = 0; i < calls; i++) work(`guess-${i}`);
  return calls / ((performance.now() - start) / 1000);
};

const sha = perSecond((guess) => createHash('sha256').update(guess).digest(), 200_000);
const argon = perSecond(
  (guess) => argon2Sync('argon2id', { message: guess, nonce: salt, memory: 19456, passes: 2, parallelism: 1, tagLength: 32 }),
  20,
);
const list = 10_000_000; // a list of likely passwords, tried against one record
const hours = (rate) => list / rate / 3600;
console.log(`SHA-256:                     ${Math.round(sha).toLocaleString('en')} guesses a second`);
console.log(`Argon2id m=19 MiB, t=2, p=1: ${Math.round(argon).toLocaleString('en')} guesses a second`);
console.log(`10,000,000 guesses: ${(list / sha).toFixed(1)} s with SHA-256, ${hours(argon).toFixed(0)} hours with Argon2id`);
console.log(`Argon2id costs about ${Math.round(sha / argon).toLocaleString('en')} times more per guess, and 19 MiB of memory`);

SHA-256:                     1,021,307 guesses a second
Argon2id m=19 MiB, t=2, p=1: 37 guesses a second
10,000,000 guesses: 9.8 s with SHA-256, 75 hours with Argon2id
Argon2id costs about 27,662 times more per guess, and 19 MiB of memory

In the recorded run each Argon2id guess cost about 28,000 times as much as a SHA-256 guess. A password hashing functionpassword hashing function: A slow, salted function for storing passwords, such as Argon2id, scrypt, bcrypt or PBKDF2, tuned so that every guess at a stolen record costs an attacker real time and, for the memory-hard ones, memory. is built to be slow on purpose, with a cost factorcost factor: A setting that makes a password hash slower on purpose, such as bcrypt's cost, PBKDF2's iterations or Argon2id's memory and passes. It is raised as computers get faster, as far as the server can bear. you raise as computers get faster. Two more properties finish the job. A saltsalt: A non-secret value mixed into a key derivation or a password hash. HKDF may reuse one fixed salt, while every stored password record needs its own random salt, so that equal passwords give different records., a random value stored with each record, gives two people with the same password different records, so an attacker must guess for every record separately instead of hashing the list once for the whole table. And a memory-hard functionmemory-hard function: A function that needs a large block of memory for every evaluation, such as Argon2id or scrypt, so that hardware running many guesses side by side pays for memory in each of them as well as for computing. needs a block of memory for every guess, so hardware built to run many guesses side by side pays for memory in each of them, not only for arithmetic.

Argon2id, scrypt, bcrypt and PBKDF2, and one record that stores its settings

Current guidance names four functions, and OWASP’s Password Storage Cheat Sheet ranks them. Argon2id comes first. When it is missing, scrypt takes its place; bcrypt belongs to legacy systems that have neither; and PBKDF2 is the choice whenever FIPS-140 compliance is a requirement:

Argon2id is the variant RFC 9106 tells you to choose when you are unsure, and its memory and passes are set apart. scrypt is memory-hard as well, with one cost, N, that sets its memory and its time together. bcrypt is slow but not memory-hard, and it reads at most 72 bytes of a password. PBKDF2 repeats HMAC as often as you ask, so it is slow but cheap to run on many guesses at once. A function you use must give its published values, so the program runs the Argon2id test vector of RFC 9106 through Node’s built-in argon2Sync and through Web Crypto:

// The Argon2id test vector of RFC 9106 section 5.3 through node:crypto's argon2Sync (Node.js 24.7.0 and later) and
// through Web Crypto's Argon2id, which Node.js 24 offers as an experimental algorithm and announces with a warning.
import { argon2Sync } from 'node:crypto';

process.removeAllListeners('warning'); // print Node's warning as one plain line instead of its default form
process.on('warning', (w) => console.log(`(Node.js says: ${w.name}: ${w.message})`));

const RFC_TAG = '0d640df58d78766c08c037a34a8b53c9d01ef0452d75b65eb52520e96b01e659';
const password = Buffer.alloc(32, 0x01); // the vector's inputs: 32, 16, 8 and 12 bytes
const salt = Buffer.alloc(16, 0x02);
const secret = Buffer.alloc(8, 0x03);
const associated = Buffer.alloc(12, 0x04);

const tag = argon2Sync('argon2id', {
  message: password,
  nonce: salt,
  secret,
  associatedData: associated,
  memory: 32, // KiB: the smallest Argon2 allows for 4 lanes, 8 per lane
  passes: 3,
  parallelism: 4,
  tagLength: 32,
}).toString('hex');
console.log(`argon2Sync: ${tag}`);
console.log(`  as RFC 9106 section 5.3: ${tag === RFC_TAG}`);

const key = await crypto.subtle.importKey('raw-secret', password, 'Argon2id', false, ['deriveBits']);
const params = { name: 'Argon2id', nonce: salt, secretValue: secret, associatedData: associated, memory: 32, passes: 3, parallelism: 4 };
const web = Buffer.from(await crypto.subtle.deriveBits(params, key, 256)).toString('hex');
console.log(`Web Crypto: as RFC 9106 section 5.3: ${web === RFC_TAG}`);

argon2Sync: 0d640df58d78766c08c037a34a8b53c9d01ef0452d75b65eb52520e96b01e659
  as RFC 9106 section 5.3: true
(Node.js says: ExperimentalWarning: The Argon2id Web Crypto API algorithm is an experimental feature and might change at any time)
Web Crypto: as RFC 9106 section 5.3: true

Both match the RFC’s tag. Whatever the function, the stored record carries everything needed to check a password later, in the PHC string formatPHC string format: A text format for password records, $id$v=version$settings$salt$hash, as in $argon2id$v=19$m=19456,t=2,p=1$…, so that one record carries everything needed to check a password later.: the function, its version, the settings, the salt and the hash. Step through one record from sign-up to login:

Because the record carries its own settings, a login years later still checks it correctly, whatever the policy has moved to by then.

What memory and passes cost, measured, with RFC 7914's vectors Pro: opens with a Pro, Premium or Ultimate pass

Choosing settings from guidance, with worked numbers Pro: opens with a Pro, Premium or Ultimate pass

Records that carry their settings, read strictly, with a lab Pro: opens with a Pro, Premium or Ultimate pass

Practise

Test the two ideas of the opening sections. Questions come weakest idea first, get harder as you answer well, and return when you slip:

Interview questions

Key takeaways

• A thief guesses passwords rather than breaking the hash, so the cost of each guess protects a record: SHA-256 allowed about 28,000 guesses for every Argon2id guess in the recorded run.
• A salt per record makes every record a separate target, and a memory-hard function makes every guess pay for memory as well as computing.
• Choose Argon2id first, scrypt where Argon2id is missing, PBKDF2 where FIPS-140 compliance is required, and bcrypt only for legacy stores, and check any implementation against its RFC’s vectors, as RFC 9106’s Argon2id vector was.
• Store the function, its settings, the salt and the hash together in one PHC string, so every record can be checked with its own settings years later.