OWASP Password Hashing Recommendations 2025 – Java Security

Direct Answer

OWASP's 2025 Password Storage guidance prefers Argon2id, with one listed minimum configuration of 19 MiB memory, 2 iterations, and parallelism 1. If Argon2id is unavailable, use scrypt with a recommended cost profile. bcrypt with cost 10 or more is mainly for legacy systems where Argon2id and scrypt are unavailable; remember its 72-byte limit. For FIPS-validated environments, OWASP lists PBKDF2-HMAC-SHA-256 with 600,000 or more iterations. Benchmark, use unique salts, and migrate as guidance changes.

Code Example

@Bean
PasswordEncoder passwordEncoder() {
    return new Argon2PasswordEncoder(
        16,        // salt length in bytes
        32,        // output length in bytes
        1,         // parallelism
        19 * 1024, // memory in KiB
        2);        // iterations
}

This matches one OWASP-listed minimum. Load-test it on the deployment platform, consider stronger settings when capacity allows, and use an encoded/delegating format so future policy changes can migrate existing verifiers.

Common Mistakes & Pitfalls

• Not using Argon2id when available: Many freshers default to bcrypt because it's in tutorials, unaware OWASP now prefers Argon2id for its memory-hardness advantage against GPU attacks.
• Using too-low cost factors: Setting bcrypt cost to 4-6 or PBKDF2 iterations below 100,000 makes hashing too fast—attackers can brute-force efficiently. OWASP minimums exist because hardware gets faster every year.
• Forgetting unique salts: Using a global salt or no salt lets attackers crack multiple passwords at once with precomputed tables. Every password must have its own random salt generated at hash time.