bcrypt vs Argon2

July 19, 2026 · 14 min read

bcrypt dominated password storage for years. Argon2 won the Password Hashing Competition (2015) and adds memory-hardness that resists GPU and ASIC cracking better at equal time costs. Both are far superior to MD5 or bare SHA-256 for passwords.

Greenfield services often choose Argon2id; mature codebases frequently stay on bcrypt until a deliberate migration. This comparison helps you decide and tune either algorithm.

Password hashing landscape

Scrypt is another memory-hard option (used in some cryptocurrencies and older systems). OWASP recommends Argon2id, bcrypt, or scrypt for new systems. Plain SHA-256, MD5, and unsalted hashes fail audits.

Regardless of algorithm, enforce strong passwords or passkeys, MFA for sensitive accounts, and breach detection on known password dumps.

bcrypt strengths

Bcrypt is ubiquitous - every major language has bindings. Cost factor is one dial (2^cost). Strings are self-describing and easy to store in a VARCHAR column. Decades of production use mean fewer surprises for ops teams.

Limitation: bcrypt truncates passwords beyond 72 bytes (not usually an issue for UTF-8 passwords, but relevant for passphrases encoded oddly). GPU attacks still scale; cost must rise over time.

Argon2 strengths

Argon2id blends Argon2i (side-channel resistant) and Argon2d (GPU resistant). You tune time cost, memory (KB), and parallelism. Memory hardness forces attackers to allocate RAM per guess, not just ALU cycles.

Argon2id example parameters (OWASP starting points - measure on your hardware):
  memory: 19 MiB (19456 KiB)
  iterations: 2
  parallelism: 1

Tuning parameters

For bcrypt, increase cost until hashing takes a few hundred milliseconds. For Argon2, set memory as high as your app servers tolerate under peak login load, then adjust time and parallelism. Document parameters in code so you can rehash on login when upgrading.

Load-test registration and login storms after raising costs - CPU and memory spikes can surprise you at scale.

What to pick

Choose Argon2id for new systems with maintained libraries (e.g. argon2 npm, libsodium). Choose bcrypt when your stack, compliance tooling, or team expertise already standardizes on it - still audit-safe when cost is current.

Migrating: on successful login, verify with old hash, rehash with new algorithm, store updated string. Support both formats during transition.

FAQ

Is bcrypt broken?: No. It remains acceptable when properly tuned. Argon2 is preferred for new designs needing memory hardness.
Argon2d vs Argon2i vs Argon2id?: Use Argon2id for password hashing unless you have a specialized threat model.
Can I switch from bcrypt to Argon2?: Yes, gradually rehash on login. Do not bulk-convert without the plaintext.
What about PBKDF2?: PBKDF2-HMAC-SHA256 is acceptable (e.g. FIPS environments) with high iteration counts. Prefer Argon2id or bcrypt when allowed.

Related: How password hashing works

Browse all tools