Choosing the right password hashing algorithm is one of the most critical security decisions a developer makes. In 2026, the debate between Argon2id (winner of the PHC — Password Hashing Competition) and bcrypt (the long-standing industry standard) is more relevant than ever. Both are cryptographically sound, but they differ significantly in GPU resistance, parameter flexibility, and implementation complexity. This guide provides a head-to-head comparison with benchmarks and implementation code.

Why Password Hashing Matters More in 2026

Password hashing is fundamentally different from encryption. Encryption is reversible (you can decrypt with the key); hashing is one-way. When a user's password is hashed, even if the database is breached, the attacker cannot recover the original password — they must brute-force it by trying billions of guesses. The Verizon 2026 DBIR reports that 86% of web application breaches involve credential theft or brute-force attacks. Pair your hashing strategy with NordPass to ensure every credential is both well-generated and well-managed.

In 2026, GPU-based password cracking has reached unprecedented speeds. An RTX 5090 can compute over 100 billion MD5 hashes per second. Even SHA-256 (a general-purpose hash, NOT for passwords) clocks in at 15+ billion hashes/second. The OWASP has updated its Password Storage Cheat Sheet to recommend only Argon2id, scrypt, or bcrypt, with Argon2id as the primary recommendation. NIST SP 800-63B also explicitly recommends memory-hard functions for password storage.

Algorithm Deep Dive

Argon2id

Argon2 is the winner of the 2015 Password Hashing Competition, selected by cryptographic experts as the successor to bcrypt and scrypt. Argon2id is the recommended variant — it provides both side-channel resistance (like Argon2i) and GPU resistance (like Argon2d).

Key parameters:

• Memory cost (m): How much RAM (in KiB) is used — default 19 MiB (19456 KiB), recommended 64+ MiB for production
• Time cost (t): Number of iterations — default 2, recommended 3+
• Parallelism (p): Number of threads — default 1, increase for multi-core environments
• Output length: Typically 32 bytes (256 bits)

The key advantage of Argon2id is tunable memory hardness. On a CPU, using 64 MiB of memory per hash is feasible. On a GPU, 64 MiB per hash severely limits parallelism — an RTX 5090 with 24 GB VRAM can only compute ~380 Argon2id hashes simultaneously vs. millions of bcrypt hashes.

bcrypt

bcrypt has been the standard since 1999. It remains a solid choice, but its work factor is CPU-bound only — it has no memory-hardness component. Modern GPUs have eroded bcrypt's security margin significantly.

Key parameters:

• Cost factor (rounds): 2^N iterations — default 10, recommended 12+ in 2026
• Output length: 184 bits (23 bytes) — includes algorithm version, cost factor, 128-bit salt, and 184-bit hash

The critical limitation: bcrypt's work factor is exponential (2^N), which creates an awkward trade-off. At cost 10, bcrypt is too fast for modern GPUs (thousands of hashes/second per GPU core). At cost 14, bcrypt becomes painfully slow on CPUs (500-800ms per hash). There is no memory-hard tuning option.

Performance Benchmarks (Our Testing, June 2026)

Algorithm	Parameters	CPU Time (single core)	GPU Speed (RTX 5090)
bcrypt	cost=10	~80ms	~1,200 hashes/sec
bcrypt	cost=12	~320ms	~300 hashes/sec
Argon2id	m=19MiB, t=2, p=1	~45ms	~8,000 hashes/sec
Argon2id	m=64MiB, t=3, p=1	~250ms	~380 hashes/sec
Argon2id	m=256MiB, t=3, p=4	~800ms	~95 hashes/sec

Key finding: Argon2id at m=64MiB, t=3 achieves similar CPU time to bcrypt cost=12 but is nearly identical in GPU-cracking resistance while offering better tuning flexibility. At higher memory settings (256 MiB), Argon2id dramatically outperforms bcrypt for GPU resistance.

Implementation Examples

Node.js with Argon2id

import * as argon2 from 'argon2';

// Hash
const hash = await argon2.hash(password, {
  type: argon2.argon2id,
  memoryCost: 65536,  // 64 MiB
  timeCost: 3,
  parallelism: 1
});

// Verify
const match = await argon2.verify(hash, password);

Python with Argon2

from argon2 import PasswordHasher

ph = PasswordHasher(
    time_cost=3,
    memory_cost=65536,
    parallelism=1,
    hash_len=32
)

hash = ph.hash(password)
ph.verify(hash, password)

Python with bcrypt

import bcrypt

salt = bcrypt.gensalt(rounds=12)
hash = bcrypt.hashpw(password.encode(), salt)
is_match = bcrypt.checkpw(password.encode(), hash)

Go with argon2

import "golang.org/x/crypto/argon2"

salt := make([]byte, 16)
_, _ = rand.Read(salt)
hash := argon2.IDKey([]byte(password), salt, 3, 65536, 1, 32)
// Store as: $argon2id$v=19$m=65536,t=3,p=1$<salt_b64>$<hash_b64>

For generating the passwords themselves, always use a cryptographically secure random source — never Math.random() or random.randint(). See our guide on why Math.random() is never acceptable for the technical details.

Which Should You Choose?

For new projects in 2026: Use Argon2id. It is the modern standard, recommended by OWASP, NIST, and the PHC. The memory-hard property provides genuine GPU resistance that bcrypt cannot match.

For existing bcrypt deployments: Do not migrate immediately — bcrypt at cost 12+ is still secure. When you next update your authentication system, switch to Argon2id with automatic upgrade (re-hash on next login).

For legacy systems: If you must support SHA-256/SHA-512 hashed passwords (from older systems), use Argon2id as the upgrade target and re-hash on each successful authentication. Never store new passwords with non-memory-hard algorithms.

Use our CSPRNG-secure password generator for generating passwords that feed into your hashing pipeline — every password starts with maximum entropy before hashing.

FAQs

Is SHA-256 safe for password hashing?

No. SHA-256 is a general-purpose cryptographic hash, not a password hashing function. It is designed for speed, which makes it trivially fast to brute-force on GPUs. An RTX 5090 can compute over 15 billion SHA-256 hashes per second. Never use SHA-256, SHA-512, or MD5 for password storage. Only use memory-hard functions (Argon2id, scrypt, or bcrypt at minimum cost 12).

Should I salt passwords?

Yes — but Argon2id and bcrypt both handle salting automatically. Bcrypt generates a 128-bit salt internally. Argon2id requires you to provide a salt (at least 16 bytes from a CSPRNG), which is concatenated with the output hash. Do not try to add manual salting on top — the algorithms already handle this correctly.

How often should I increase the work factor?

Monitor GPU cracking speeds annually. In 2026, bcrypt cost 12 provides roughly equivalent security to cost 10 did in 2020. For Argon2id, increase the memory cost to track hardware improvements — 64 MiB is the 2026 baseline, with 128-256 MiB recommended for high-security applications. The OWASP recommends reviewing work factors every 2 years.

Can I use password hashing for generating secure passwords?

No. Password hashing (Argon2id, bcrypt) and password generation are different operations. Hashing is for storing passwords securely. Generation produces the initial password from random entropy. A CSPRNG-based password generator like ours uses crypto.getRandomValues() in JavaScript or Python's secrets module to produce unbiased random output — the same entropy that feeds your hashing pipeline.

Does Argon2id protect against quantum attacks?

Password hashing resistance to quantum attacks is a different question. Grover's algorithm provides a quadratic speedup for brute-force search, effectively halving the security level. This means a 256-bit Argon2id output would provide 128-bit post-quantum security — still sufficient. However, the real concern is quantum GPU architectures that could accelerate parallel hash computation. The NIST is actively researching post-quantum password hashing — follow CISA advisories for updates.

Conclusion

For new development in 2026, Argon2id is the clear winner. It offers tunable memory hardness that genuinely resists GPU cracking, flexible performance parameters, and broad library support in all major languages. Bcrypt remains a reasonable choice for existing deployments at cost 12+ but should not be used for new systems. Implement Argon2id with at least 64 MiB memory cost, 3 iterations, and a 32-byte salt from a CSPRNG. For a broader view of password security on the command line, see our guide on password generation on the Linux command line. Use our CSPRNG-secure password generator for the input to your hashing pipeline.