← Graph

Use Argon2id when you need pepper

takeaway 2 connections

If pepper is needed or unbounded-length passwords are desired, use Argon2id. It is the 2015 PHC winner, supports salt and pepper natively as arguments, is OWASP-recommended, and for new applications is a drop-in swap. Remember to limit password length to prevent DoS attacks on long passwords.

type
recommendation
takeaway Use Argon2id when you need pepper
about
Argon2 tool
Recommendation is about adopting Argon2id.
takeaway Use Argon2id when you need pepper
from_talk
Devise pitfalls and way to tighten security talk
Primary remediation recommended in the talk.

Provenance

Created in
Devise pitfalls and way to tighten security — Rafał Rothe... 2026-04-17 21:52