#argon2

A password hash is the one function in your codebase you want to be slow. One RTX 4090 runs MD5 at 164 billion guesses a second and bcrypt at 184 thousand. Here are the parameters OWASP, RFC 9106 and NIST actually publish, and why memory cost is the setting that hurts an attacker most.