Argon2id vs bcrypt: which password hash to use in 2026

bcrypt is built on the Blowfish key schedule. It runs an expensive setup 2^cost times, so each +1 doubles the work. Its working memory is small and fixed (about 4 KB), which means a GPU can run many guesses in parallel cheaply.

Argon2id fills a block of memory of size m, makes t passes over it with data-dependent and data-independent addressing (the 'id' hybrid resists both GPU cracking and side channels), and can split work across p lanes. An attacker must pay for m bytes of fast memory per guess, which is what makes large-scale cracking expensive. Argon2d and Argon2i also exist; for password hashing use Argon2id.

from argon2 import PasswordHasher
from argon2.exceptions import VerifyMismatchError

ph = PasswordHasher(time_cost=2, memory_cost=19456, parallelism=1)  # memory in KiB

stored = ph.hash("correct horse battery staple")
# '$argon2id$v=19$m=19456,t=2,p=1$<salt>$<hash>'

def check(stored: str, password: str) -> bool:
    try:
        ph.verify(stored, password)
    except VerifyMismatchError:
        return False
    if ph.check_needs_rehash(stored):
        pass  # parameters changed: rehash and save
    return True

import bcrypt

pw = "correct horse battery staple".encode()
if len(pw) > 72:
    raise ValueError("bcrypt only uses 72 bytes")

stored = bcrypt.hashpw(pw, bcrypt.gensalt(rounds=12))
# b'$2b$12$<22 char salt><31 char hash>'

def check(stored: bytes, password: str) -> bool:
    return bcrypt.checkpw(password.encode(), stored)

Both verify functions compare in constant time and read the salt and parameters from the stored string, so you never store them separately.

• New system with a maintained Argon2 library: Argon2id.
• Tune on your production hardware: raise memory first, then iterations, until a hash takes roughly 200 to 500 ms at your login peak.
• Watch memory under load: 64 MiB per hash times 200 concurrent logins is 12.5 GiB. Cap concurrency or lower m with higher t.
• Stuck on a platform with only bcrypt: bcrypt at cost 12 or more, with an explicit 72 byte check.
• FIPS 140 mandated: PBKDF2-HMAC-SHA-256 with at least 600,000 iterations, per OWASP.
• Add a pepper (secret key held in a KMS or HSM, applied as HMAC before hashing) if a database-only leak is a realistic threat.

1. Store the full encoded string; the prefix ($2b$ or $argon2id$) tells you which algorithm to verify with.
2. On successful login with a bcrypt hash, rehash the plaintext you just verified with Argon2id and overwrite.
3. For dormant accounts, optionally wrap: store argon2id(bcrypt_hash) and verify by computing bcrypt then Argon2id, so old hashes gain memory hardness without the password.
4. Track the share of each prefix and, after a deadline, force reset for any account still on bcrypt.