When you are choosing a password hashing algorithm, you are really choosing a strategy for slowing down attackers. All three of the serious options (bcrypt, scrypt, and Argon2) do this, but they take fundamentally different approaches. Understanding those differences will help you pick the right one for your application.
The Three Approaches to Slowing Down Attackers
Password hashing algorithms fight attackers by making each hash computation expensive. But "expensive" can mean different things:
**CPU-hard** means the algorithm requires a lot of processor time. Each hash takes a meaningful number of CPU cycles. An attacker trying billions of guesses needs a lot of CPU power (or a lot of time). Bcrypt is the classic example of a CPU-hard algorithm.
**Memory-hard** means the algorithm requires a lot of RAM. Each hash computation needs a large block of memory, and you cannot reduce it without making the computation even slower. This is powerful because memory is far more expensive than processing power. You can buy a GPU with thousands of cores for a few hundred dollars, but each core still has limited memory. scrypt pioneered this approach.
**Both** means the algorithm is designed to be both CPU-hard and memory-hard, making it resistant to both parallel processing and specialized hardware. Argon2 was designed from the ground up to combine both approaches optimally.
Bcrypt: The Battle-Tested Workhorse
Bcrypt was designed in 1999 and is still the most widely used password hashing algorithm in the world. It is CPU-hard: each hash requires a configurable number of iterations (the cost factor), and you can increase this over time as hardware improves.
**Strengths:** - 25+ years of real-world testing with no discovered vulnerabilities - Supported by virtually every programming language and framework - Simple to implement (most libraries handle everything in one function call) - Adaptive cost factor lets you keep up with hardware improvements - The salt is embedded in the hash, so there is no separate salt management
**Weaknesses:** - Only CPU-hard, not memory-hard. An attacker with specialized hardware (ASICs or high-end GPUs) can parallelize attacks more effectively than with memory-hard algorithms - 72-byte password limit. Passwords longer than 72 bytes are silently truncated - Fixed 184-bit hash output, which is smaller than some modern alternatives
For a deeper look at how bcrypt works, see our bcrypt explained post.
scrypt: The Memory Pioneer
scrypt was designed by Colin Percival in 2009 specifically to be memory-hard. It was originally created for Tarsnap, an online backup service, but quickly found adoption as a password hashing function.
**Strengths:** - Memory-hard: requires a configurable amount of RAM per hash, making GPU and ASIC attacks much more expensive - Adjustable parameters for CPU cost, memory cost, and parallelism - No password length limit (unlike bcrypt's 72 bytes)
**Weaknesses:** - Less widely supported than bcrypt, though still available in most modern libraries - Parameter tuning is more complex than bcrypt's single cost factor. You need to choose N (CPU/memory cost), r (block size), and p (parallelism), and getting the balance right requires testing - Some parameter choices can be too memory-intensive for shared hosting environments - Less battle-tested than bcrypt, though still well over a decade of production use
Argon2: The Modern Champion
Argon2 was the winner of the 2015 Password Hashing Competition, a contest that attracted 24 submissions from cryptographers around the world. It was specifically designed to address the limitations of both bcrypt and scrypt.
There are three variants: - **Argon2d**: maximizes resistance to GPU cracking but is vulnerable to side-channel attacks - **Argon2i**: resistant to side-channel attacks but slightly less resistant to GPU cracking - **Argon2id**: a hybrid that uses Argon2i for the first pass and Argon2d for subsequent passes. This is the recommended variant for password hashing.
**Strengths:** - Both CPU-hard and memory-hard, providing the best of both approaches - Resistant to side-channel attacks (Argon2id variant) - Configurable memory, CPU time, and parallelism parameters - No password length limit - Recommended by OWASP as the primary choice for password hashing - Winner of a formal academic competition with peer review
**Weaknesses:** - Newer than bcrypt, with less real-world testing (though still over a decade old at this point) - Not as universally supported. Most modern languages have libraries, but you may need to install additional dependencies - Parameter tuning is more complex. You need to choose memory cost (m), time cost (t), and parallelism (p) - Some shared hosting environments do not have the library installed
What OWASP Recommends
OWASP (the Open Web Application Security Project) maintains a password storage cheat sheet that is widely considered the industry standard. As of 2026, their recommendations are:
1. **Argon2id** is the primary recommendation, with a minimum memory cost of 19 MiB, minimum time cost of 2, and minimum parallelism of 1. 2. **scrypt** is an acceptable alternative, with a minimum CPU/memory cost of N=2^17, block size r=8, and parallelism p=1. 3. **bcrypt** is an acceptable alternative, with a minimum work factor of 10 and a maximum of 1024 bits of password input (the 72-byte limit).
All three are considered acceptable. The key requirement is that you use one of them, not that you use a specific one. If you are using MD5, SHA-1, or plain SHA-256, you should migrate immediately. Our migration guide walks through how to do that without resetting passwords.
When to Use Each One
**Use bcrypt when:** You want simplicity and universal support. Bcrypt is the safest choice in terms of ecosystem maturity. Every framework, every language, every hosting provider supports it. If you are building a typical web application and do not have unusual security requirements, bcrypt with cost 12 is a perfectly defensible choice.
**Use scrypt when:** You want memory hardness but Argon2 is not available in your environment. scrypt is a solid middle ground between bcrypt's simplicity and Argon2's modern design. It is particularly good for cryptocurrency-related applications where it is already widely used.
**Use Argon2id when:** You are building a new application and want the best available protection. If your hosting environment supports it (most do in 2026), Argon2id with well-chosen parameters is the strongest option. It is also the best choice for applications with particularly high security requirements.
Migration Paths
If you are already using one of these algorithms, you generally do not need to switch. The security difference between bcrypt cost 12 and Argon2id with good parameters is real but not dramatic for most threat models. Both will make password cracking impractical for typical attackers.
If you are using MD5 or SHA-1, you should migrate to one of these three as soon as possible. The migration does not require resetting passwords. You can use the dual-hash strategy: wrap the old hash in a new bcrypt or Argon2 hash, then gradually upgrade as users log in. We cover this in detail in our migration guide.
If you want to switch from bcrypt to Argon2 (or vice versa), the same gradual migration approach works. When a user logs in, verify against the old hash, then re-hash with the new algorithm and store it.
The Bottom Line
All three algorithms are good choices. The worst choice is using none of them. If you are paralyzed by the decision, start with bcrypt. It is the easiest to implement, the most widely supported, and has the longest track record. You can always migrate to Argon2id later using the gradual migration strategy.
Want to experiment with bcrypt parameters? Try our bcrypt generator to see how different cost factors affect hash output and timing.
