Security
bcrypt vs Argon2 vs PBKDF2: Password Hashing Compared
Storing passwords as plaintext or fast hashes is a recipe for disaster. bcrypt, Argon2, and PBKDF2 are deliberately slow, salted key-derivation functions built to make offline password cracking expensive. They differ in how they resist GPUs and custom hardware, and that difference matters. Choosing the right one — and the right parameters — is one of the most important security decisions in any application that handles user credentials.
1.Why Fast Hashes Are Wrong for Passwords
SHA-256 and MD5 are designed to be fast, which is exactly why they are terrible for password storage. An attacker who steals a password database can try billions of guesses per second against fast hashes using GPUs. Password-hashing functions solve this by being intentionally slow and resource-hungry, multiplying the cost of each guess so that brute-forcing becomes impractical. They also use a per-user salt so that identical passwords produce different hashes and precomputed rainbow tables are useless.
2.bcrypt: The Battle-Tested Standard
bcrypt (1999) is based on the Blowfish cipher and is the most widely deployed password-hashing function. It is salted by design, produces a 60-character string that includes the salt and cost factor, and its work factor (rounds) can be increased over time to keep pace with faster hardware. bcrypt resists GPUs well because its memory access pattern and design are not a perfect fit for massively parallel hardware. Its practical weakness is a 72-byte input limit on the password and fixed memory usage, which leaves it behind modern memory-hard functions.
3.Argon2: The Modern Winner
Argon2 won the Password Hashing Competition in 2015 and is the current gold standard. It is memory-hard — it requires a configurable amount of RAM, which makes GPU and ASIC attacks far more expensive — and offers three variants: Argon2d (data-dependent, maximally resistant to GPU cracking), Argon2i (data-independent, resistant to side-channel attacks), and Argon2id (a hybrid, recommended for most uses). Because its memory, iterations, and parallelism are all tunable, Argon2id is the algorithm most security experts recommend for new systems today.
4.PBKDF2: The Conservative Option
PBKDF2 (Password-Based Key Derivation Function 2, RFC 2898) is one of the oldest and most portable KDFs, used in WPA2, iOS, and many frameworks. It works by applying a PRF (typically HMAC-SHA256) thousands of times. PBKDF2 is easy to implement correctly and widely supported, but it is not memory-hard — it can be attacked efficiently with GPUs and custom hardware. If you must use PBKDF2, choose a very high iteration count and rely on the framework's battle-tested implementation.
5.Making the Choice
If you control the runtime, use Argon2id with parameters tuned to roughly 100-500 MB of memory and a few seconds of compute. If you are constrained to library defaults, bcrypt with a cost factor of 12 or higher is a safe, well-understood choice. PBKDF2 is acceptable only when interoperability or platform support forces it. In every case, hash on the server, use a fresh random salt per user, and pair the hash with rate limiting and multi-factor authentication.
Try the tools
Run these conversions and checks instantly in your browser — no data leaves your device.
Frequently Asked Questions
Is Argon2 better than bcrypt?
For new systems, yes. Argon2id is memory-hard, which makes GPU-based cracking dramatically more expensive, and its memory, time, and parallelism parameters are tunable. bcrypt remains a safe choice when you cannot use Argon2.
Why is bcrypt not memory-hard?
bcrypt uses a fixed, relatively small amount of memory and its computational pattern is not optimized for massive parallelism, so GPUs cannot crack it as efficiently as they crack fast hashes — but it still lacks the configurable memory-hardness of Argon2.
Should I use a hash generator to create password hashes?
A general hash generator computes fast hashes (MD5, SHA) for integrity checks — never use those for passwords. For secure password hashes, use a dedicated bcrypt tool or a proper password-hashing library in your backend.
How can I test the strength of passwords?
Use our password strength analyzer to evaluate length, character variety, and entropy. Strong password policies combined with Argon2id or bcrypt hashing provide defense in depth.
More comparisons
Explore side-by-side guides for other developer tools and formats.
View all comparisons