The answer
Gradually. On next login, verify the old bcrypt hash, then rehash the password with argon2 and save. Store a marker for which algorithm each user is on. Eventually all users are on argon2. No big-bang migration needed.
bcrypt vs Other Password Hashing Algorithms
How do I migrate from bcrypt to argon2?
More FAQs in bcrypt vs Other Password Hashing Algorithms
argon2id for new projects with no constraints (modern, memory-hard, side-channel resistant). bcrypt with 10-12 rounds for existing projects or simple setup. PBKDF2 only if you need a standard built into Node. Avoid raw SHA hashes.
argon2 is memory-hard (requires lots of RAM), so ASICs are expensive to build. bcrypt is not memory-hard, so an attacker with ASICs can brute-force faster. argon2id is also side-channel resistant.
Yes, with 10-12 salt rounds. It is not the most modern option (argon2 is better), but it is battle-tested, easy to use, and safe for most apps. Use 12 rounds for high-security apps.
Still have questions?
Browse all our FAQs or reach out to our support team
Want to upskill yourself?
Your learning library
Small steps. Big possibilities.
Find your next course. Build something great.