Argon2id vs. bcrypt vs. SHA-256: How Password Hashing Stops Cracking
Understand how Argon2id, bcrypt, PBKDF2, and SHA-256 work, why salting and memory-hard KDFs stop GPU password cracking, and why length still matters.
Quick Answer: Argon2id (winner of the Password Hashing Competition and OWASP's #1 recommendation in 2026) is the most secure password hashing algorithm because it is both CPU-hard and memory-hard, forcing attackers to allocate megabytes of RAM per guess and defeating GPU/ASIC parallelism. bcrypt (cost factor 12+) remains a strong second choice, whereas general-purpose cryptographic hashes like MD5, SHA-1, and unslowed SHA-256 are completely unsafe for passwords because GPUs can compute billions of them per second.
However, because you as a user can never know whether a website stores your password using modern Argon2id or an outdated fast hash, your only guaranteed defense is generating a unique 16 to 20+ character password (~105 to 131 bits of entropy) using our free browser-only Password Generator.
Why Fast Cryptographic Hashes (MD5, SHA-1, SHA-256) Are Terrible for Passwords
Algorithms like SHA-256 were engineered to verify massive files and TLS certificates as fast as silicon allows. When a developer mistakes a fast hash for a password storage function, they hand offline crackers an enormous speed advantage:
- An 8-GPU rig can evaluate roughly 180 billion MD5/NTLM hashes per second and 25 billion SHA-256 hashes per second.
- By contrast, a password Key Derivation Function (KDF) like Argon2id, scrypt, or bcrypt intentionally introduces configurable computational work and memory latency so that verifying one login takes ~100–250 milliseconds on a server CPU, throttling an entire 8-GPU cracking rig down to just 25,000 to 120,000 guesses per second (a 1,000,000× slowdown).
2026 Password Hashing Algorithm Comparison Table (OWASP & NIST)
| Algorithm | GPU Resistance | Memory Hardness | 8-GPU Crack Speed | Recommended 2026 Parameters (OWASP) | Security Rating |
|---|---|---|---|---|---|
| Argon2id (RFC 9106) | Maximum | Yes (19–64 MiB RAM/hash) | ~25,000 H/s | m=19456 (19 MiB), t=2, p=1 + 128-bit salt |
#1 Gold Standard |
| scrypt (RFC 7914) | Very High | Yes (configurable RAM) | ~45,000 H/s | N=2^17 (128 MiB), r=8, p=1 |
Strong Alternative |
| bcrypt | High (4 KB state) | Fixed 4 KB (FPGA-vulnerable) | ~120,000 H/s | Cost factor 12 or 13 (watch 72-byte limit) |
Good Legacy Standard |
| PBKDF2-HMAC-SHA256 | Moderate (CPU-only) | No (GPU-parallelizable) | ~3.5 million H/s | 600,000+ iterations (FIPS 140-3 environments) |
Acceptable Only for FIPS |
| Raw SHA-256 / MD5 / NTLM | None | None | 25B – 180B H/s | Never use directly for password storage | Critically Broken |
How Cryptographic Salts and Peppers Protect Password Databases
- Unique Per-User Salt (128-Bit Random Value): A salt is a unique random string generated via a CSPRNG and stored alongside each user's password hash. Salting ensures that if two users pick the same password, their database hashes look completely different, rendering precomputed rainbow tables useless and forcing attackers to crack each account individually.
- Server-Side Pepper (HMAC Secret): A pepper is a secret cryptographic key stored outside the database (inside a Hardware Security Module or cloud KMS) that is combined with the password before or after hashing. Even if an SQL injection attack dumps the entire user table, the attacker cannot crack a single hash without also breaching the KMS pepper.
- The bcrypt 72-Byte Truncation Gotcha: Classic
bcryptsilently truncates inputs after 72 bytes. If you use long passphrases, modern password managers like Bitwarden and 1Password use PBKDF2-SHA256 (600,000+ iterations) or Argon2id so that every character of your multi-word passphrase contributes to the final vault key.
Why Client-Side Entropy Still Matters Even When Websites Use Argon2id
Even Argon2id running at 25,000 guesses per second will fall in seconds if your password appears in a leaked dictionary or uses a simple word-plus-year pattern. Audit your credentials locally with our Password Strength Checker and generate 16 to 20 character random passwords so your accounts stay safe even if a website uses weak legacy hashing.
Frequently Asked Questions
Why is Argon2id better than Argon2i or Argon2d?
Argon2id is a hybrid mode that uses data-independent memory access in the first pass (like Argon2i, protecting against side-channel timing attacks) and data-dependent memory access in subsequent passes (like Argon2d, maximizing resistance against GPU time-memory trade-off attacks).
When should an organization still use PBKDF2 instead of Argon2id?
Only when strict government compliance requires NIST FIPS 140-3 validated cryptographic modules that do not yet include Argon2id. In those environments, OWASP recommends PBKDF2-HMAC-SHA256 with at least 600,000 iterations (or PBKDF2-HMAC-SHA512 with 210,000 iterations).
Does salting a password make a weak password strong?
No. A cryptographic salt stops rainbow tables and prevents an attacker from cracking millions of accounts simultaneously, but an attacker targeting your specific account can still test billions of dictionary words against your known salt plus password hash.
We focus on practical, privacy-first password guidance and update articles when recommendations change.