Is scrypt secure in 2026?

Yes. scrypt has no practical breaks as of 2026. Caveats worth knowing: None practical when parameters are tuned (N ≥ 2^17 for online auth in 2026).

What is scrypt used for?

Memory-hard password hashing when Argon2id isn't available. Cryptocurrencies derived from Litecoin.

How should scrypt output be stored?

scrypt produces a 256-bit derived key, but you do not store that on its own. The output goes in a modular crypt format string that also carries the salt and the cost parameters, so a future verify knows how the stored value was produced. Never store a bare digest for a password.

Can scrypt be used to hash passwords?

Yes. scrypt is a password hashing function, designed to be deliberately slow and tuned through cost parameters so that an attacker who steals the database cannot test candidate passwords cheaply.

Colin Percival, published in 2009.

Hash Lab

securepassword · 256 bits · 2009

scrypt

Colin Percival's memory-hard answer to bcrypt's GPU vulnerability. Used by Litecoin and a long tail of password databases.

By Deepak Gupta · Last updated May 28, 2026

scrypt was the first widely deployed *memory-hard* password hash. Its tuning parameters force any attacker to spend RAM as well as CPU per password attempt, which makes GPU and FPGA cracking far less cost-effective than against bcrypt. Memory-hardness is the right property for a password hash, and scrypt remains a perfectly defensible choice. The reason most new designs reach for Argon2id instead is the parameter story: Argon2 was designed in the modern-attacker era and exposes three orthogonal knobs (time, memory, parallelism), giving you finer control over the trade-off curve.

Recommended uses

·Memory-hard password hashing when Argon2id isn't available
·Cryptocurrencies derived from Litecoin

Known attacks / caveats

·None practical when parameters are tuned (N ≥ 2^17 for online auth in 2026).

Designed by

Colin Percival, published 2009.

Try it in the password-hash demo →

Deep dive on guptadeepak.com

The Complete Guide to Password Hashing: Argon2 vs Bcrypt vs Scrypt vs PBKDF2 (2026)

The deep-dive on which password-hashing function to pick and how to tune it.

Frequently asked questions

Is scrypt secure in 2026?: Yes. scrypt has no practical breaks as of 2026. Caveats worth knowing: None practical when parameters are tuned (N ≥ 2^17 for online auth in 2026).
What is scrypt used for?: Memory-hard password hashing when Argon2id isn't available. Cryptocurrencies derived from Litecoin.
How should scrypt output be stored?: scrypt produces a 256-bit derived key, but you do not store that on its own. The output goes in a modular crypt format string that also carries the salt and the cost parameters, so a future verify knows how the stored value was produced. Never store a bare digest for a password.
Can scrypt be used to hash passwords?: Yes. scrypt is a password hashing function, designed to be deliberately slow and tuned through cost parameters so that an attacker who steals the database cannot test candidate passwords cheaply.
Who created scrypt?: Colin Percival, published in 2009.