Question 1

What is scrypt?

Accepted Answer

Scrypt is a memory-hard key derivation function designed by Colin Percival in 2009 for Tarsnap (RFC 7914). Unlike PBKDF2 and bcrypt, scrypt requires substantial RAM per attempt — at the recommended N=16384 r=8 p=1 parameters, each hashing operation needs ~16MB of memory. This makes GPU and ASIC attacks much more expensive, because each parallel attacker needs its own 16MB chunk. Scrypt is used by Tarsnap, Litecoin (LTC), Dogecoin, and many cryptocurrency wallets for key derivation.

Question 2

What do N, r, p mean?

Accepted Answer

N is the CPU/memory cost — must be a power of 2. Higher N means slower hashing AND more memory. r is the block size — usually 8. p is the parallelization factor — usually 1. Memory usage is approximately 128 * N * r bytes. RFC 7914 recommends N=16384, r=8, p=1 for interactive use (~16MB, ~50ms on a modern CPU). For file encryption or stronger protection, N=1048576, r=8, p=1 (~1GB memory, several seconds). The combination of CPU cost (from N rounds of Salsa20) and memory cost (from holding N blocks) is what makes scrypt memory-hard.

Question 3

Scrypt or Argon2?

Accepted Answer

Argon2 is generally preferred for new systems — it's the winner of the 2015 Password Hashing Competition and was specifically designed to improve on scrypt's design. Argon2 has clearer parameter semantics (memory, time, parallelism are explicit), better resistance against specific cryptographic attacks, and is included in modern standards like RFC 9106. Use scrypt when you need compatibility with existing systems (Litecoin, Tarsnap, scrypt-based password managers) or when scrypt-js's smaller bundle is preferable to argon2-browser's larger WASM payload.

Scrypt Generator

Frequently Asked Questions