Scrypt Password Generator
Hash a password with scrypt, the memory-hard key derivation function. Set the salt, cost (N), block size (r), parallelization (p), and key length, and get the hash as a PHC string, hex, and Base64. Runs in your browser.
Input
Output
Readme
What is scrypt?
scrypt is a password hashing function, or key derivation function, designed by Colin Percival in 2009 and published as RFC 7914. Like bcrypt and Argon2, it is slow on purpose, so every guess costs an attacker time. It is also memory-hard: each hash fills a large block of memory and reads it back in an unpredictable order, which makes cracking with GPUs and custom chips far more expensive. scrypt is used for password storage in many web frameworks, in Node.js, Python, and Go standard libraries, and in cryptocurrency wallets such as Ethereum keystores.
Tool description
This tool hashes a password with scrypt in your browser. It starts with a random salt and the settings OWASP recommends for password storage, and you can change the salt, the cost (N), the block size (r), the parallelization (p), and the key length. The hash is ready as a PHC string for password libraries, and as hex and Base64 for code that stores the salt and the parameters on its own.
Features
- Hashes a password with scrypt as defined in RFC 7914
- Creates a random 16-byte salt, with a button to make a new one
- Takes your own salt, to reproduce a hash made elsewhere
- Sets the cost (N) from 2⁴ to 2²⁰, the block size (r), the parallelization (p), and the key length
- Gives the hash as a PHC string, hex, and Base64
- Shows the progress of slow hashes and warns when the settings need more than 1 GiB of memory
- Runs in your browser, so the password never leaves your device
Parameters
| Parameter | Default | What it does |
|---|---|---|
| Cost (N) | 131072 (2¹⁷) | Number of memory blocks. Doubling it doubles the time and the memory. |
| Block size (r) | 8 | Size of each block, 128 × r bytes. Also scales time and memory. |
| Parallelization (p) | 1 | Number of independent runs. Multiplies the time, not the memory. |
| Key length | 32 bytes | Length of the hash. |
The memory needed is 128 × N × r bytes, which is 128 MiB with the defaults.
Output formats
The PHC string holds everything needed to check the password later: the algorithm, the parameters, the salt, and the hash, with the salt and the hash in Base64 without padding:
$scrypt$ln=17,r=8,p=1$<salt>$<hash>ln is the base-2 logarithm of N, so ln=17 means N = 131072. This is the format that Python's passlib, the Rust scrypt crate, and the Node.js @phc/scrypt package read and write.
The hex and Base64 fields hold only the hash, as returned by crypto.scrypt in Node.js, hashlib.scrypt in Python, and scrypt.Key in Go. Store the salt and the parameters next to it.
How it works
The salt field is read as text and encoded as UTF-8, the same as passing a string salt to Node.js crypto.scrypt. The random salt is 16 random bytes written as 32 hex characters, and those 32 characters are the salt that gets hashed. The password is encoded as UTF-8 too. The hash is computed in a background thread, so the page stays responsive, and it starts again when you change any input.
Tips
- Use a new random salt for every password. The same password with the same salt always gives the same hash.
- OWASP recommends at least N = 2¹⁷, r = 8, p = 1 for password storage. Raise N as far as your server can afford per login.
- Node.js limits scrypt to 32 MiB of memory by default. Pass a higher
maxmemtocrypto.scryptwhen you use N = 2¹⁷ or more with r = 8. - To check a hash from another system, enter the same password, salt, and parameters and compare the results.