.tip

Fast hashes are for checksums. Password hashes have to be slow on purpose, and tunable as hardware gets faster.

import { hash, verify } from "@node-rs/argon2";
const stored = await hash(password, { memoryCost: 65536, timeCost: 3, parallelism: 1 });
const ok = await verify(stored, password);

Aim for about a quarter of a second per hash on your server. bcrypt with a cost of 12 is the acceptable fallback if argon2 is not available.