Bcrypt vs scrypt Comparison

Bcrypt vs scrypt Comparison

scrypt, designed by Colin Percival in 2009, was the first widely adopted memory-hard password hashing function. It was created specifically to make hardware-accelerated attacks expensive by requiring large amounts of memory. Bcrypt, while older, offers simplicity and a larger ecosystem.

Design Philosophy

Bcrypt — makes password hashing slow through CPU-intensive computation (repeated Blowfish key scheduling). Uses a fixed, small amount of memory (~4 KB).

scrypt — makes password hashing expensive through both CPU time and memory consumption. An attacker must allocate significant RAM for each parallel hash attempt, limiting GPU and ASIC effectiveness.

Parameter Comparison

Parameter	Bcrypt	scrypt
Time control	Cost factor (1 param)	N — CPU/memory cost (1 param)
Memory control	Fixed ~4 KB	r — block size, p — parallelism
Total params	1	3 (N, r, p)
Typical memory	4 KB	16–128 MB

scrypt Parameters Explained

• N (CPU/memory cost): Must be a power of 2. Higher values increase both time and memory. Common values: 2^14 to 2^20
• r (block size): Controls the memory block size. Typical value: 8
• p (parallelism): Number of parallel chains. Typical value: 1

The total memory used is approximately: 128 × N × r bytes.

GPU Resistance

scrypt’s memory-hardness makes it significantly harder to attack with GPUs:

• A GPU with 8 GB of memory running scrypt with N=2^20 and r=8 can only run ~8 parallel instances (each needing ~1 GB)
• The same GPU running bcrypt can run thousands of parallel instances (each needing only 4 KB)

However, scrypt’s memory-time trade-off is not perfect — an attacker can use less memory at the cost of more computation, a weakness that Argon2 addressed.

Practical Considerations

Advantages of scrypt:

• Better GPU/ASIC resistance than bcrypt
• Proven track record (used by cryptocurrency mining, Tarsnap)
• Available in most languages

Advantages of bcrypt:

• Simpler API — one parameter vs three
• More battle-tested for password hashing specifically
• Better library support across frameworks
• Easier to configure correctly
• Harder to misconfigure (scrypt’s three parameters create more opportunities for error)

Configuration Mistakes

scrypt’s three-parameter design creates more room for errors:

• Setting N too low negates the memory-hardness benefit
• Setting p > 1 without understanding the implications can reduce effective security
• Using r=1 significantly reduces memory requirements

Current Recommendation

For new projects, Argon2id is generally preferred over both bcrypt and scrypt, as it combines memory-hardness with side-channel resistance. Between bcrypt and scrypt specifically, bcrypt’s simplicity and ecosystem support make it the safer default unless you specifically need memory-hardness and cannot use Argon2.