# How to make my hash more robust to the brute force?

I'm using PBKDF2 SHA 256 with 100 000 iterations to generate a secret.

I want to increase the cost of brute forcing the passphrase I use to generate the secret.

I'm thinking of using scrypt after the pbkdf2 computation.

scrypt(pbkdf2(passphrase, salt))


Is there a better way?

• Have you considered using Argon2? crypto.stackexchange.com/q/30785/54184 – forest Dec 29 '18 at 10:46
• – forest Dec 29 '18 at 10:49
• Should we migrate? Also look at some figures for some of the upmost systems. – kelalaka Dec 29 '18 at 10:50
• I think this question can stay here as it's essentially about the theory of password hashing. – SEJPM Dec 29 '18 at 13:25
• Same as this answer, use only the strongest of the two. (Which is scrypt) Argon2 is even better. – Future Security Dec 29 '18 at 19:18