Password Hashing: Argon2id vs bcrypt vs PBKDF2 & Salt Hardness
Standard cryptographic hashes (SHA-256, MD5) execute in nanoseconds, making them dangerously susceptible to GPU brute-force attacks. Password hashing functions (Argon2id, bcrypt) are computationally expensive and memory-hard, enforcing unique random salts per user.
The Vault Lock with a Sand Timer: SHA-256 is a lock that opens in 1 microsecond (a thief can try 1,000,000,000 keys per second). Argon2id forces the lock to wait 300 milliseconds and fill a 64MB memory bucket on every single guess, making GPU cracking economically impossible.
// Argon2id Password Hashing (OWASP Recommendation):
import argon2 from 'argon2';
async function hashPassword(password: string): Promise<string> {
return argon2.hash(password, {
type: argon2.argon2id, // Hybrid memory-hard & side-channel resistant
memoryCost: 65536, // 64 MB of RAM per hash
timeCost: 3, // 3 iterations
parallelism: 4 // 4 threads
});
}
async function verifyPassword(password: string, hash: string): Promise<boolean> {
return argon2.verify(hash, password);
}Key Architectural Takeaways
- •Unique Cryptographic Salt: Prevents precomputed Rainbow Table attacks by ensuring two identical passwords produce completely different hash outputs.
- •Memory Hardness: Argon2id requires large chunks of RAM, rendering ASIC/GPU hardware clusters ineffective.
- •Work Factor Scaling: Hash complexity can be tuned upwards over time as computer hardware gets faster.
Hashing passwords with fast algorithms like SHA-256 or MD5, even with a salt; modern GPUs can compute over 100 billion SHA-256 hashes per second.
Always use Argon2id, bcrypt (cost factor >= 12), or PBKDF2 (>= 600,000 iterations).