Plan-execute on OWASP vs NIST on password hashing

Short answer. If the service falls under FIPS or federal requirements, use PBKDF2 with HMAC-SHA-256 at 600,000 or more iterations, running in a FIPS 140-validated cryptographic module. That is OWASP's own FIPS fallback, and it appears to fit NIST SP 800-63B-4 as well, though NIST's text does not name PBKDF2 itself (see the NIST section). If FIPS does not apply, OWASP's first choice is Argon2id.

What OWASP recommends

Source: https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html. I read the whole page.

• First choice. Its summary says to use Argon2id with a minimum of 19 MiB of memory, 2 iterations and 1 degree of parallelism. The detailed section lists equivalent settings, for example m=47104 (46 MiB) with t=1, or m=12288 (12 MiB) with t=3.

• Fallbacks.

  • scrypt if Argon2id is unavailable, with N=2^17, r=8, p=1.
  • bcrypt only for legacy systems, with a work factor of at least 10 and a 72-byte password limit.
• FIPS case. "If FIPS-140 compliance is required, use PBKDF2 with a work factor of 600,000 or more and set with an internal hash function of HMAC-SHA-256." The PBKDF2 section adds that PBKDF2 "should be the preferred algorithm when these are required". It lists 600,000 iterations for HMAC-SHA256, 220,000 for HMAC-SHA512, and 1,400,000 for HMAC-SHA1. SHA-1 is marked legacy only, not for new systems.
• Migration. It advises storing the algorithm and work factor with each hash, allowing a mix of old and new hashes during a transition, and re-hashing when users next log in.
• Pepper. It suggests a pepper for defense in depth.

What NIST SP 800-63B-4 requires

Source: https://pages.nist.gov/800-63-4/sp800-63b.html. The page is SP 800-63B-4 and carries a date stamp of 26 Aug 2025. Its abstract says it "supersedes NIST Special Publication (SP) 800-63B", so Revision 4 is the current revision. I did not open the NIST publication PDF, so I did not check any final-publication date beyond this page's stamp.

• Hashing and salting (Sec. 3.1.1.2).

  • Passwords SHALL be salted and hashed using a suitable password hashing scheme.
  • The cost factor SHOULD be as high as practical and increased over time.
  • An approved scheme from the latest SP 800-132 or updated NIST guidance SHOULD be used.
  • The salt SHALL be at least 32 bits.
  • The scheme and cost factor SHOULD be stored with each password to allow migration.
  • Verifiers SHOULD also add a keyed-hash or encryption step using a secret key kept separately, ideally in an HSM or TEE.

• Length and composition.

  • Single-factor passwords must be at least 15 characters. Passwords used only within multi-factor authentication must be at least 8.
  • Verifiers SHOULD permit a maximum length of at least 64 characters.
  • Other composition rules SHALL NOT be imposed.
  • Periodic forced changes SHALL NOT be required.
  • Passwords must be checked against a blocklist, and verifiers must rate-limit failed attempts.
  • The whole password must be verified, "not truncate it".
• FIPS 140. For federal agencies' verifiers, "Cryptography used by verifiers operated by or on behalf of federal agencies at AAL1 SHALL be validated to meet the requirements of [FIPS140] Level 1." The same applies at AAL2 "unless otherwise specified". At AAL3, verifier cryptography must be validated at Level 1 or higher.
• What NIST does not say. I searched the page and found no mention of PBKDF2, and no mention of Argon2 (the only "Argon" hit is the word "jargon"). It defers to "an approved password hashing scheme published in the latest revision of [SP800-132] or updated NIST guidelines". I did not open SP 800-132, so I can't confirm from a source I read what it lists as approved. OWASP says PBKDF2 "is permitted by NIST SP 800-63B-4".

Reconciling the two

1. The sources are not in conflict, but they differ in strength and in what they name. NIST's rule that the hashing scheme be "approved" is a SHOULD, and it names no algorithm. OWASP is non-normative guidance that names algorithms. The only place a NIST requirement is expressed as a SHALL for FIPS is the validation of verifier cryptography for federal agencies.
2. Choose PBKDF2-HMAC-SHA-256 for the FIPS path. It is the only algorithm in OWASP's list that OWASP ties to FIPS-140 validated implementations and to NIST permission. Use at least 600,000 iterations, and tune upward by benchmarking, since NIST says the cost should be "as high as practical". The password-handling rules above apply regardless of algorithm.
3. Use a validated module. NIST's FIPS requirement is about validated cryptography, so use a library or module with a CMVP validation. Whether a given module covers PBKDF2 must be checked against its validation certificate. The pages I read don't say.
4. Argon2id is the choice only if FIPS does not apply. That is my inference. Neither page says Argon2id is FIPS-approved, and NIST does not name it. If the service is a federal verifier, or serves agencies, treat Argon2id as not demonstrated to be allowed unless NIST guidance or your assessor says otherwise.
5. Plan for migration. Store the algorithm and cost with each hash, as both sources recommend, so you can raise the cost or change algorithm later. NIST says it expects updated guidance on password hashing schemes.
6. Optional hardening. Add a secret-keyed HMAC step (a pepper) held in an HSM. Both sources recommend it, and NIST says to store the key separately and ideally in hardware.

Gaps. I did not confirm whether your service is formally in scope for FIPS, which depends on your contract or agency. I did not open SP 800-132, FIPS 140, or any CMVP certificate.

{"evidence": [
{"claim": "OWASP's first-choice recommendation is Argon2id with a minimum configuration of 19 MiB, 2 iterations, parallelism 1.", "quote": "Use Argon2id with a minimum configuration of 19 MiB of memory, an iteration count of 2, and 1 degree of parallelism.", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"},
{"claim": "OWASP says to use PBKDF2 with at least 600,000 iterations and HMAC-SHA-256 when FIPS-140 compliance is required.", "quote": "If FIPS-140 compliance is required, use PBKDF2 with a work factor of 600,000 or more and set with an internal hash function of HMAC-SHA-256.", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"},
{"claim": "OWASP says PBKDF2 is permitted by NIST SP 800-63B-4, has FIPS-140 validated implementations, and should be preferred when those are required.", "quote": "Since PBKDF2 is permitted by NIST SP 800-63B-4 and has FIPS-140 validated implementations, it should be the preferred algorithm when these are required.", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"},
{"claim": "OWASP lists scrypt as the fallback if Argon2id is unavailable and bcrypt only for legacy systems.", "quote": "The bcrypt password hashing function should only be used for password storage in legacy systems where Argon2 and scrypt are not available.", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"},
{"claim": "OWASP gives PBKDF2 iteration counts per hash and marks SHA-1 as legacy only.", "quote": "PBKDF2-HMAC-SHA256: 600,000 iterations (recommended)", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"},
{"claim": "OWASP advises storing algorithm and work factor with the hash and allowing mixed hashes during migration.", "quote": "During the transition period, allow for a mix of old and new hashing algorithms.", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"},
{"claim": "NIST SP 800-63B-4 supersedes the earlier SP 800-63B, so Revision 4 is current; the page is dated 26 Aug 2025.", "quote": "This publication supersedes NIST Special Publication (SP) 800-63B.", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"claim": "NIST requires passwords to be salted and hashed with a suitable password hashing scheme.", "quote": "Passwords SHALL be salted and hashed using a suitable password hashing scheme.", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"claim": "NIST says an approved scheme from SP 800-132 or updated NIST guidance SHOULD be used (no specific algorithm named), and the cost factor should be as high as practical.", "quote": "An approved password hashing scheme published in the latest revision of [SP800-132] or updated NIST guidelines on password hashing schemes SHOULD be used.", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"claim": "NIST requires a salt of at least 32 bits and recommends storing the scheme and cost factor to allow migration.", "quote": "The salt SHALL be at least 32 bits in length and chosen to minimize salt value collisions among stored hashes", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"claim": "NIST recommends storing the scheme and cost factor with each password to allow migration.", "quote": "A reference to the password hashing scheme used, including the cost factor, SHOULD be stored for each password to allow migration to new algorithms and work factors.", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"claim": "NIST recommends an additional keyed hashing step with a secret key stored separately, ideally in hardware-protected storage.", "quote": "The secret key value SHALL be stored separately from the hashed passwords.", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"claim": "NIST sets a 15-character minimum for single-factor passwords and 8 for passwords used only in multi-factor authentication.", "quote": "Verifiers and CSPs SHALL require passwords that are used as a single-factor authentication mechanism to be a minimum of 15 characters in length.", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"claim": "NIST prohibits other composition rules.", "quote": "Verifiers and CSPs SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types) for passwords.", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"claim": "For federal-agency verifiers at AAL1, cryptography must be FIPS 140 Level 1 validated.", "quote": "Cryptography used by verifiers operated by or on behalf of federal agencies at AAL1 SHALL be validated to meet the requirements of [FIPS140] Level 1.", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"claim": "NIST says FIPS 140 requirements are satisfied by implementations validated under the CMVP.", "quote": "Throughout this document, [FIPS140] requirements are satisfied by security technologies, products, and services that utilize implementations of cryptography validated by the Cryptography Module Validation Program [CMVP].", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"}
]}