Password Hashing & KDF

PBKDF2, bcrypt, scrypt, Argon2 (password hashing) and HKDF (key derivation) algorithms

What is Password Hashing & KDF?

Password hashing is a special type of hashing used to securely store user passwords. Unlike normal hash algorithms, password hashing algorithms are intentionally slow and add random data called "salt". This way, even if an attacker steals the password database, it becomes very difficult and time-consuming to crack the passwords. Modern password hashing algorithms provide protection against brute-force attacks and are critical for secure password storage.

Use Cases

Web application password storage
User authentication systems
Database security
Mobile application security
API authentication
Password management systems

Key Features

Intentional slowness (brute-force protection)
Salt required, pepper optional
One-way function
Configurable difficulty
Memory-hard algorithms (Argon2)
Secure password storage
Argon2id recommended for new systems; minimum parameters: m≥64–128 MiB, t≥2–3, p≥1
For compatibility: PBKDF2-HMAC-SHA256, iterations ≥100k+

Algorithm Comparison

Algorithm	Security	Speed	Use Cases
PBKDF2 (HMAC-SHA256/512 seçilebilir)	High	Slow	General-purpose password hashingSystems requiring compatibilityFor compatibility: PBKDF2-HMAC-SHA256, iterations ≥100k+
bcrypt	High	Slow	Web applicationsMedium security requirements
Argon2id	Very High	Slow	Recommended for new systemsHigh-security applicationsModern systemsMinimum parameters: m≥64–128 MiB, t≥2–3, p≥1