Argon2id vs PBKDF2, explained

Argon2id and PBKDF2 are both key derivation functions — they turn a password into an encryption key while making each guess deliberately slow. The decisive difference: Argon2id is memory-hard, PBKDF2 is not. Because of that, Argon2id resists the GPU and ASIC rigs used for mass password cracking far better than PBKDF2 — even when PBKDF2 is run at a high iteration count like 600,000.

What a key derivation function is for

Your password isn't used directly as an encryption key — it's usually too short and not random enough. A KDF stretches it into a proper key and adds deliberate cost, so that an attacker who captures your encrypted data and tries to guess the password has to pay that cost for every single guess. A good KDF turns "a billion guesses a second" into something far slower and far more expensive.

PBKDF2: make it slow by repeating

PBKDF2 adds cost by repeating a hash many times — 600,000 iterations means hashing 600,000 times per guess. That's genuinely useful, and a modern iteration count is much stronger than the defaults of ten years ago. Its weakness is structural: the work is pure computation and needs almost no memory. Graphics cards and purpose-built ASICs are extraordinarily good at doing enormous amounts of that kind of computation in parallel — so an attacker with the right hardware can still run a staggering number of guesses per second.

Argon2id: make it need memory

Argon2id adds a second kind of cost: each guess must fill and churn through a large block of RAM. Memory is exactly what cheap, massively parallel cracking hardware lacks — you can fit thousands of hashing cores on a chip, but not thousands of large, fast memory banks beside them. By forcing every guess to use memory, Argon2id blunts the attacker's biggest advantage. It's also the id variant, which blends two approaches to resist both side-channel attacks and GPU cracking. Argon2 won the open Password Hashing Competition in 2015 and is now the common recommendation for new systems.

How to read a KDF claim

• Name the function. "Bank-grade encryption" tells you nothing. A credible vault names its KDF — Argon2id, scrypt, PBKDF2 — and ideally its parameters.
• Check for memory-hardness. Argon2id and scrypt are memory-hard; PBKDF2 is not. For protecting a human-chosen password, that property is the one to look for.
• Parameters matter too. Argon2id has a memory cost, a time cost and a parallelism setting; a tiny memory cost undercuts the point. PBKDF2's security scales with its iteration count.
• Remember the password still rules. Any KDF only buys time. A long, random passphrase is what makes that time astronomically long.

The crypto, in the open

// PBKDF2 — compute-hard only (cheap on memory)
pbkdf2 = { iterations: 600000, memory: "~none" };

// Argon2id — memory-hard (what Kistvault uses)
argon2id = {
  memory:      "high (MiB per guess)",  // the GPU/ASIC blocker
  time:        t,
  parallelism: p,
};

Illustrative — exact Argon2id parameters are tuned per device in the app and pinned to shared test vectors across iOS and Android.

Questions