.tip

Fast hashes are for checksums. A password hash has to be slow on purpose, and you need to be able to make it slower as hardware gets faster.

import { hash, verify } from "@node-rs/argon2";
const stored = await hash(password, { memoryCost: 65536, timeCost: 3, parallelism: 1 });
const ok = await verify(stored, password);

Aim for about a quarter of a second per hash on your own server. If argon2 isn't available, bcrypt with a cost of 12 is an acceptable fallback.