How do scrypt's N, r, and p parameters work?

N is the CPU/memory cost (must be a power of 2), r is the block size, and p is the parallelisation factor. Memory usage is roughly 128 * N * r bytes. A common baseline is N=2^15, r=8, p=1 (~32 MB).

When should I pick scrypt over Argon2?

Pick Argon2id by default for new applications — it's the OWASP recommendation. scrypt is fine for compatibility with existing systems (Litecoin, Tarsnap, many TLS libraries) or where an audited scrypt is available but Argon2 is not.

Is my password processed locally?

Yes. scrypt runs in your browser via WebAssembly; the password and salt never leave your device.

scrypt · memory-hard · noble · on-demand

Derive keys with scrypt

Memory-hard password hashing — makes large-scale GPU/ASIC attacks expensive. Used by Litecoin, many TLS libraries, and RFC 7914. Runs entirely in your browser.

scrypt Generator

Password

28 B

28 chars

Cost

N=16384

r=8 p=1

Key

—

32 B

Status

idle

noble

input · password

output · derived key hex

—

Quick Start

How scrypt works

scrypt mixes a large memory buffer using PBKDF2 + ROMix. Memory-hardness forces attackers to pay for RAM, not just compute.

01
Enter password & salt
Salt must be unique per user. 16 random bytes is a sensible minimum.
Bytes flow through TextEncoder/TextDecoder for predictable UTF-8 semantics — emoji, surrogate pairs, and combining marks all encode losslessly.
inputUTF-8TextEncoderlosslesslive
input · raw bytespw+salt · UTF-8
```
p / salt
```
loaded · UTF-8MIME · ready
02
Pick N, r, p
OWASP defaults: N=16384, r=8, p=1. Memory ≈ 128·N·r bytes (≈ 16 MiB at defaults).
Hash and signature operations call crypto.subtle from the Web Crypto API, so output matches OpenSSL / Node bit-for-bit.
costWeb Cryptosubtledeterministiclive
cost · optionsN=16k · live
```
r=8 p=1
```
options applied · livelive
03
Run scrypt
Hashing is on-demand because it can take seconds. Click the button to start.
Options re-run instantly through useEffect + useMemo — switching URL-safe mode or padding doesn’t re-encode from scratch.
runmemoisedoptionsinstantreactive
run · encodedgo · ready
```
processing…
```
encoded · livelossless
04
Copy or download
One click to clipboard. Download as .txt.
Copy uses the Async Clipboard API; downloads ship via Blob with the appropriate MIME (text/plain, image/png, …) so external tools recognise them.
exportclipboardblobMIME-correctclient-side
ok · copiedready · done
```
Copied
```
shipped · ready to shipsuccess

Pro tips

Encoding without surprises

Always UTF-8 first

Use TextEncoder / TextDecoder for bytes ↔ string conversion. btoa alone breaks on non-ASCII.

URL-safe vs standard Base64

Standard uses +, /, =; URL-safe swaps to -, _, no padding. Don’t mix them.

Hashes aren’t passwords

SHA-256 is fast; that’s good for fingerprints, bad for passwords. Use bcrypt / argon2 for credentials.

Watch padding rules

Some decoders are strict about = padding, others auto-pad. If round-trips fail at exactly 1 or 2 bytes, check padding.

Use Web Crypto for keys

Generate cryptographic keys via crypto.subtle, never Math.random. The latter is predictable.

JWT decode ≠ verify

Decoding a JWT just splits and base64-decodes. Verification needs the issuer’s public key / shared secret.

Use Cases

When to use scrypt

Memory-hard password hashing without the Argon2 dependency.

Password storage

Stronger than PBKDF2 against GPU attacks. Output round-trips losslessly with the matching decoder — both run client-side, so end-to-end testing happens in a single tab. Encoding flows through TextEncoder for predictable UTF-8 semantics.

RFC-compliant

Disk encryption

Derive volume keys from passphrases. Web Crypto's subtle.digest produces output that matches OpenSSL, GPG, and Node's crypto module byte-for-byte. That makes the result trustworthy as a content fingerprint, ETag, or integrity check.

OpenSSL-matched

Litecoin mining

Litecoin's PoW uses scrypt for ASIC resistance. Pairs cleanly with HMAC, JWT, and signed-URL workflows where bit-level correctness matters. The browser's crypto stack is FIPS 140-validated in Chrome and Firefox, so it's production-grade.

lossless

TLS PSK

Some embedded TLS stacks derive keys with scrypt. Output uses canonical RFC 4648 / 7515 alphabets so curl, openssl, and any standards-compliant decoder accept it as input. URL-safe variants drop padding for tokens that travel in query strings.

byte-identical

Backup keys

Derive deterministic backup keys from a passphrase. Heavy hashing runs through useMemo so large inputs don't block typing. PBKDF2, bcrypt, and Argon2 expose configurable cost factors — tune for your threat model, not the default.

spec-grade

Test fixtures

Match RFC 7914 test vectors exactly. Same input plus same options always yields identical bytes. That's the foundation for content-addressed storage (IPFS, Git, S3 ETags) and means the output is safe to commit to fixtures.

production-ready

FAQ

Frequently asked questions

scrypt vs Argon2?

Argon2id is generally the better choice today. scrypt is older, well-studied, and ubiquitous when Argon2 is not available.

What do N, r, p mean?

N is CPU/memory cost (must be a power of two), r is block size (memory granularity), p is parallelism. Memory ≈ 128·N·r bytes.

Why is hashing on-demand?

scrypt with reasonable parameters can take 100–500 ms. Running it on every keystroke would freeze the page.

How do I tune parameters?

Pick the largest N (and matching r, p) that takes ~250 ms on your slowest production server.

Is anything sent to a server?

No. scrypt is computed in your browser via @noble/hashes and runs locally.

Suggest a tool

Something missing?

Tell us what you need. We ship the top requests every two weeks.

47 in queue·8 shipped this month

Request queued. Thanks!