Cybersecurity glossary
What is scrypt?
Learn what scrypt is, how memory-hard parameters resist GPU cracking, how it compares with bcrypt and Argon2, and which settings matter for password storage.
Definition
scrypt is a memory-hard password-based key-derivation function that mixes a large amount of RAM into its computation so that massively parallel password-guessing hardware becomes more expensive to operate.
Why scrypt changed password cracking economics
CPU-only slow hashes still fall to dense GPU farms. scrypt was designed so each guess needs a sizable memory footprint, reducing how many parallel crackers fit on a card. That idea influenced later designs such as Argon2 and remains relevant wherever passphrase-derived keys protect valuable data.
What scrypt optimizes for
Memory hardness
Large working sets raise the cost of parallel attack hardware.
Tunable parameters
N, r, and p let operators balance UX latency against cracking cost.
Password-based derivation
Outputs can be verifiers or encryption keys.
Salted inputs
Unique salts remain essential against precomputation.
Password verification with scrypt
Load stored parameters
Read salt, N, r, p, and the expected derived value.
Derive with scrypt
Compute the function over the submitted password.
Compare carefully
Use a constant-time comparison against the stored verifier.
Enforce online limits
Rate-limit and monitor stuffing regardless of hash strength.
Rehash when upgrading
After success, rewrite with stronger parameters or Argon2id if migrating.
scrypt among common password KDFs
Choose based on threat model, library maturity, and compliance constraints.
| Algorithm | Memory-hard | Notes |
|---|---|---|
| scrypt | Yes | Strong legacy memory-hard choice |
| Argon2id | Yes | Often preferred for new password storage |
| bcrypt | No (CPU-focused) | Still common and acceptable if tuned |
| PBKDF2 | No | Raise iterations or migrate |
Operational checklist
- Use a maintained scrypt library rather than a custom implementation.
- Generate a unique salt per password and store parameters with the hash.
- Benchmark N/r/p so authentication remains available under peak load.
- Increase memory cost intentionally when raising difficulty.
- Protect auth services against resource exhaustion from expensive hashes.
- Consider migrating new verifiers to Argon2id while supporting scrypt reads.
- Never log passwords or intermediate scrypt buffers.
- Combine with MFA and breach-detection controls.
Parameter fear is rational
Undersized memory makes scrypt closer to a plain slow hash. Oversized memory turns login into a self-DoS. Treat parameter selection like capacity planning: measure, document, and revisit when hardware or attacker economics change.
The practical takeaway
scrypt is a memory-hard KDF that raises the cost of parallel password guessing. Tune N/r/p carefully, keep salts unique, and prefer Argon2id for greenfield password storage when you can.
Related security terms
Argon2
The Password Hashing Competition winner often preferred for new systems.
bcrypt
A widely deployed adaptive password hash without scrypt-style memory hardness.
PBKDF2
An iteration-based KDF that lacks scrypt’s memory cost.
Key Derivation Function (KDF)
The broader category scrypt belongs to.
Salt (Cryptography)
Per-password salts remain mandatory with scrypt.
Frequently asked questions
What is scrypt in simple terms?
scrypt turns a password into a hash or key while forcing the computer to use a lot of memory, which makes large-scale password cracking more expensive.
Is scrypt still a good choice?
Yes, scrypt remains a solid memory-hard option. For brand-new password storage, Argon2id is often preferred, but correctly tuned scrypt is far better than plain hashes or weak PBKDF2.
What do N, r, and p mean in scrypt?
N is the CPU/memory cost factor, r is the block size parameter, and p is the parallelization parameter. Together they control time and memory usage.
Does scrypt replace bcrypt?
It can. scrypt’s memory hardness addresses a class of GPU attacks bcrypt does not stress as strongly. Migration should be planned carefully with rehash-on-login.
Can scrypt derive encryption keys?
Yes. scrypt is frequently used to derive keys from passphrases for file or disk encryption designs.
What happens if parameters are too high?
Authentication servers can run out of memory or become easy to DoS with login spikes. Benchmark on production-like hosts.
Do I still need a salt with scrypt?
Yes. Always use a unique salt per password.
References
Explore authoritative guidance and frameworks related to scrypt.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.