Scrypt hash will appear here
Enter a password and configure parameters| Use Case | N | r | p | Memory |
|---|---|---|---|---|
| Interactive login | 16384 | 8 | 1 | ~16 MB |
| Recommended | 32768 | 8 | 1 | ~32 MB |
| Sensitive storage | 65536 | 8 | 1 | ~64 MB |
| High security | 1048576 | 8 | 1 | ~1 GB |
Every coffee helps keep the servers running. Every book sale funds the next tool I'm dreaming up. You're not just supporting a site — you're helping me build what developers actually need.
Scrypt is a password-based key derivation function created by Colin Percival in 2009 for the Tarsnap backup service. It's designed to be memory-hard, requiring significant RAM to compute, making it resistant to large-scale custom hardware attacks (GPUs, FPGAs, ASICs).
Must be a power of 2. Determines overall memory and CPU usage. Doubling N doubles both time and memory. Primary parameter to increase security.
Controls memory read size. Affects memory bandwidth usage. Typical value is 8. Higher values increase memory per-block but may reduce parallelism benefits.
Allows parallel computation. Each parallel thread needs N×r memory. Useful for multi-core systems. Usually kept at 1 for password hashing.
| Algorithm | Memory-Hard | GPU Resistant | Configurable | Notes |
|---|---|---|---|---|
| Scrypt | Yes | High | N, r, p | Good choice, proven in production (Litecoin, Tarsnap) |
| Argon2 | Yes | High | t, m, p | PHC winner (2015), recommended for new applications |
| BCrypt | Limited | Medium | Cost only | Fixed 4KB memory, still widely used |
| PBKDF2 | No | Low | Iterations | NIST recommended but GPU-vulnerable |
Python
import hashlib
dk = hashlib.scrypt(
password.encode(),
salt=salt.encode(),
n=16384, r=8, p=1,
dklen=32
)Node.js
const crypto = require('crypto');
crypto.scrypt(password, salt, 32,
{ N: 16384, r: 8, p: 1 },
(err, key) => {
console.log(key.toString('hex'));
});Scrypt hashes are designed to be shared safely. The recipient needs the same parameters (N, r, p, salt) to verify the password. All parameters are included in this URL.