Home / Knowledge hub / scrypt
Knowledge hub
scrypt
A password hashing function that needs a lot of memory, which slows cracking hardware.
What it means
scrypt is a password-based key derivation function designed by Colin Percival and standardised in RFC 7914. Its feature is that it needs a large amount of memory as well as time. That makes it costly to run on graphics cards and custom chips, which have plenty of processing cores but little memory per core.
You tune it with three settings. N is the CPU and memory cost, r is the block size, and p is the amount of parallelism. Memory use is roughly 128 bytes times N times r, so the settings decide how much RAM each single password check reserves.
Why it matters
Older designs, such as PBKDF2, are slow but use almost no memory, so attackers can run huge numbers of guesses side by side on cheap hardware. Requiring memory narrows that gap and raises the cost of cracking a stolen set of hashes.
It is an accepted second choice. OWASP lists Argon2id first and scrypt where Argon2id is not available, with a minimum of N of 2^17, r of 8 and p of 1, which is about 128 MiB per hash. That is plenty for a sign-in check and a lot for a cracking rig.
How it shows up
You meet it in language libraries and in some password storage code. The stored string records the settings and salt. Memory is the thing to watch: a login page that reserves 128 MiB per attempt can be pushed into exhaustion by many sign-in requests at once, which is a form of denial of service.
Mistakes: settings copied from a tutorial that were low even when written, no rate limit on the sign-in route, and no plan to adjust as hardware improves. Put limits on concurrent logins, measure memory under load, and see Argon2 if your platform supports it.
Questions people ask
scrypt, answered
Is scrypt better than bcrypt?
It resists specialised hardware better because it needs memory, which bcrypt does not. Both are acceptable. The deciding factors are library support and whether you set the parameters properly.
Argon2id is listed ahead of both.
What are scrypt’s parameters?
N sets the CPU and memory cost and must be a power of two, r sets the block size, and p sets parallelism. Raising N or r increases memory per hash.
OWASP gives N=2^17, r=8, p=1 as a minimum.
Can scrypt cause a denial of service?
It can if each login reserves a lot of memory and nothing limits the number of requests. Rate limiting and a cap on concurrent hash operations protect the server.
Test the login route under load.
Does scrypt need a salt?
Yes, a unique random salt for every password. Libraries usually create it and store it in the output string along with the settings, so you rarely handle it yourself.
Never share one salt across accounts.
Where else is scrypt used?
Besides password storage, it appears in protecting encrypted files and cryptocurrency wallets, because it turns a passphrase into a strong key at high cost. The same tuning advice applies.
Choose settings for the device that runs it.
Sources
Where this comes from
Related
Terms that sit next to this one
Argon2
A modern password hashing function that is slow and memory-hungry on purpose.
bcrypt
A deliberately slow password hashing function with a built-in salt.
PBKDF2
An older password hashing method that repeats a hash many thousands of times.
Key derivation function (KDF)
A function that turns a password or secret into a strong, fixed-size key.
Rate limiting
Capping how often something can be attempted, per user or per address.
Could the login itself be overloaded?
Heavy hashing makes login routes expensive to abuse. We test web apps and APIs, and white-box mode reads your code while testing the running app, so a finding can point to the file and line. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.