Return to Answer

Coming up with a specific number is hard. Realistically, all three options take you well out of the realm of ever having more than the absolute worst passwords brute-forced by an attacker.

The primary gain of scrypt and argon2 over bcrypt is a hit to parallelism due to the addition of memory requirements. GPUs with thousands of cores will need (but don't have) absurd amounts of memory, so most of those cores will need to remain idle. FPGAs and ASICs become much more expensive as they have to incorporate large amounts of memory, so you're really just forcing an attacker to trade a significantly larger number of dollars for equivalent parallelism.

The primary gains of argon2 over scrypt (someone correct me if I'm wrong):

• improved resistance against Time Memory Trade-Off Attacks (TMTO),
• better side-channel resistance (scrypt is vulnerable to cache-timing attacks due to secret-dependent memory access patterns), and
• the ability to increase CPU and memory requirements independently of one-another.

Coming up with a specific number is hard. Realistically, all three options take you well out of the realm of ever having more than the absolute worst passwords brute-forced by an attacker.

The primary gain of scrypt and Argon2 over bcrypt is a hit to parallelism due to the addition of memory requirements. GPUs with thousands of cores will need (but don't have) absurd amounts of memory, so most of those cores will need to remain idle. FPGAs and ASICs become much more expensive as they have to incorporate large amounts of memory, so you're really just forcing an attacker to trade a significantly larger number of dollars for equivalent parallelism.

The primary gains of Argon2 over scrypt (anyone correct me if I'm wrong):

• improved resistance against Time Memory Trade-Off Attacks (TMTO),
• better side-channel resistance (scrypt is vulnerable to cache-timing attacks due to secret-dependent memory access patterns), and
• the ability to increase CPU and memory requirements independently of one another.

Coming up with a specific number is hard. Realistically, all three options take you well out of the realm of ever having more than the absolute worst passwords brute-forced by an attacker.

The primary gain of scrypt and argon2 over bcrypt is a hit to parallelism due to the addition of memory requirements. GPUs with thousands cores will need (but don't have) absurd amounts of memory, so most of those cores will need to remain idle. FPGAs and ASICs become much more expensive as they have to incorporate large amounts of memory, so you're really just forcing an attacker to trade a significantly larger number of dollars for equivalent parallelism.

The primary gains of argon2 over scrypt (someone correct me if I'm wrong) are better TMTO tradeoffs, better side-channel resistance (scrypt is vulnerable to cache-timing attacks due to secret-dependent memory access patterns), and the ability to increase CPU and memory requirements independently of one-another.

Coming up with a specific number is hard. Realistically, all three options take you well out of the realm of ever having more than the absolute worst passwords brute-forced by an attacker.

The primary gain of scrypt and argon2 over bcrypt is a hit to parallelism due to the addition of memory requirements. GPUs with thousands of cores will need (but don't have) absurd amounts of memory, so most of those cores will need to remain idle. FPGAs and ASICs become much more expensive as they have to incorporate large amounts of memory, so you're really just forcing an attacker to trade a significantly larger number of dollars for equivalent parallelism.

The primary gains of argon2 over scrypt (someone correct me if I'm wrong):

• improved resistance against Time Memory Trade-Off Attacks (TMTO),
• better side-channel resistance (scrypt is vulnerable to cache-timing attacks due to secret-dependent memory access patterns), and
• the ability to increase CPU and memory requirements independently of one-another.

Coming up with a specific number is hard. Realistically, all three options take you well out of the realm of ever having more than the absolute worst passwords brute-forced by an attacker.

The primary gain of scrypt and argon2 over bcrypt is a hit to parallelism due to the addition of memory requirements. GPUs with thousands cores will need (but don't have) absurd amounts of memory, so most of those cores will need to remain idle. FPGAs and ASICs become much more expensive as they have to incorporate large amounts of memory, so you're really just forcing an attacker to trade a significantly larger number of dollars for equivalent parallelism.

The primary gain of argon2 over scrypt (someone correct me if I'm wrong) is twofold. First is the use of an algorithm that's equally-well accelerated in modern CPUs as it is in GPUs or other specialized hardware (bcrypt incidentally also has this trait). scrypt relies on SHA-256, which is slow in CPUs when compared to GPUs, FPGAs, or ASICs. The second is avoidance of a time-memory tradeoff; essentially, with scrypt, an attacker can simply throw double the cores at the problem to halve memory consumption. This allows an attacker to choose whichever of the two has a lower marginal cost — usually in this case, that's cores. If I recall correctly, argon2 still allows a time-memory tradeoff, but at a disadvantage to the attacker: halving the memory requires significantly more than double the cores.

Coming up with a specific number is hard. Realistically, all three options take you well out of the realm of ever having more than the absolute worst passwords brute-forced by an attacker.

The primary gain of scrypt and argon2 over bcrypt is a hit to parallelism due to the addition of memory requirements. GPUs with thousands cores will need (but don't have) absurd amounts of memory, so most of those cores will need to remain idle. FPGAs and ASICs become much more expensive as they have to incorporate large amounts of memory, so you're really just forcing an attacker to trade a significantly larger number of dollars for equivalent parallelism.

The primary gains of argon2 over scrypt (someone correct me if I'm wrong) are better TMTO tradeoffs, better side-channel resistance (scrypt is vulnerable to cache-timing attacks due to secret-dependent memory access patterns), and the ability to increase CPU and memory requirements independently of one-another.