Password Hashing: bcrypt vs Argon2id

Subtitle: Store passwords so stolen data stays useless

Left column - bcrypt:

1999, built on the Blowfish cipher One knob: cost factor (CPU work) Salt is stored inside the hash Ignores input past 72 bytes GPU farms attack it cheaply

Right column - Argon2id:

2015 Password Hashing Competition winner Three knobs: memory, time, threads Memory-hard: starves GPUs and ASICs Blends Argon2i and Argon2d modes OWASP first choice for new systems

Simple difference:

bcrypt = make each guess slow Argon2id = make each guess slow AND costly in RAM

Use it when - bcrypt: legacy stack, tiny RAM budget, battle-tested libs Use it when - Argon2id: new build, high-value logins, RAM to spare

Sticky note - Common beginner mistake:

Hashing passwords with SHA-256 or MD5. Fast hashes are the wrong tool; you need a slow, salted, tunable KDF.