Argon2 won the 2015 Password Hashing Competition and is the current default recommendation for storing passwords. Argon2id is the variant to use unless you have a specific reason otherwise — it resists both GPU cracking and side-channel attacks. OWASP suggests m=19456, t=2, p=1 as a floor. The PHC string output is what goes in a database column.
0 chars; 0 lines
Memory cost is 19 MB per derivation, roughly 4.2 s of blocked main thread. Pure-JS Argon2 runs several times slower than a native build, so a server using the same parameters will be much quicker than this page.
0 chars; 0 lines
marduc812
© 202620260902_acd5cb6