Bcrypt vs Argon2

Bcrypt relies almost exclusively on CPU computational throughput. Its memory usage is minimal, requiring only about 4 KiB of cache space to run the Blowfish cipher tables. While this was safe in 1999, modern graphics cards (GPUs) contain thousands of small parallel processors designed to handle floating-point math and simple memory access in parallel.

An attacker who obtains a database of bcrypt hashes can offload the cracking process to custom GPU setups or specialized ASIC chips. Because bcrypt has a tiny memory footprint, the attacker can run thousands of bcrypt operations simultaneously on a single GPU. Argon2 eliminates this hardware advantage by incorporating massive memory-hard operations. To compute an Argon2 hash, the parser must read and write from a large memory buffer (often 16 MiB to 64 MiB). This memory requirement saturates the GPU's memory bus, reducing its parallel execution capability and neutralizing the attacker's hardware acceleration advantage.

Brute-force Cracking Resistance:
- Bcrypt: Uses ~4 KiB RAM. GPUs can execute thousands of hashing tasks in parallel.
- Argon2: Uses customizable RAM (e.g., 64 MiB). GPUs are severely throttled by memory bus bottlenecks.

Argon2 is implemented in three distinct variants, each optimized for different security environments:

1. **Argon2i**: This variant uses data-independent memory access. The order in which memory locations are read and written is pre-determined and does not depend on the input password. This makes it highly resistant to side-channel timing attacks, which attempt to steal cryptographic keys by measuring memory latency. It is the recommended choice for password hashing in environments where timing channels are a major concern.

2. **Argon2d**: This variant uses data-dependent memory access. The sequence of memory reads is dictated by the input password. This makes it extremely resistant to GPU/ASIC cracking arrays because the memory access pattern cannot be pre-computed. However, it is theoretically vulnerable to side-channel timing attacks if an attacker has low-level hardware access to the system.

3. **Argon2id**: This is a hybrid variant. It acts as Argon2i for the first pass over memory (securing the process against timing attacks) and as Argon2d for subsequent passes (securing against GPU acceleration). Argon2id is widely recognized by cryptographers and security standards (including RFC 9106) as the default recommended variant for general password storage.

One major architectural quirk of Bcrypt is its password length limit. Bcrypt silently truncates any input password longer than 72 bytes (characters). If a user inputs a 100-character passphrase, Bcrypt only hashes the first 72 characters and ignores the remaining 28.

This creates a security risk: if an attacker knows a user has a long passphrase, they only need to brute-force the first 72 characters to gain access. Furthermore, if the user changes characters at the end of their long passphrase (beyond the 72nd byte), the resulting hash is identical. Argon2 has no such limit; it can process passphrases up to 4 GiB, making it fully compatible with extremely long passphrases and security key exchanges.

// Bcrypt 72-byte truncation behavior
import bcrypt from 'bcryptjs';

const pass1 = "a".repeat(72) + "SECRET_TAIL";
const pass2 = "a".repeat(72) + "DIFFERENT_TAIL";

const hash1 = bcrypt.hashSync(pass1, 10);
const hash2 = bcrypt.hashSync(pass2, 10);

// Both compare to TRUE because the tail is ignored by bcrypt!
console.log(bcrypt.compareSync(pass2, hash1)); // true
console.log(hash1 === hash2); // false (due to random salt, but they validate the same)

Bcrypt is simple to configure because it only has one tuning parameter: the Cost Factor (or logarithmic rounds). A cost factor of 10 means $2^{10} = 1024$ rounds of encryption. Adjusting this parameter scales the computation time exponentially.

Argon2 offers three separate tuning dimensions to match your exact hardware profile: Memory Cost ($m$, the size of the RAM array in KiB), Time Cost ($t$, the number of execution iterations), and Parallelism ($p$, the number of threads utilized). While this makes Argon2 more complex to configure, it allows you to optimize memory usage to maximize GPU cracking costs without overloading your server CPU.