Glossary: Web App Security and Authentication

Password hashing alternatives (bcrypt, scrypt, PBKDF2)

Also written: bcrypt, scrypt, PBKDF2

Other slow password hashes OWASP lists after Argon2id. scrypt (N=2^17, r=8, p=1) is the choice if Argon2id isn't available; bcrypt (work factor 10+) is for older systems and uses only the first 72 bytes; PBKDF2 (600,000 rounds of HMAC-SHA-256) is for where FIPS rules require it.