scrypt

What it is made of

Cost (N)

1024 – 1048576, default 16384

Block size (r)

1 – 32, default 8

Parallelism (p)

1 – 16, default 1

Runs in

Your browser and the server

What it is

Memory-hard on purpose: an attacker with a warehouse of GPUs has to buy RAM too. The default here and in the rest of Leumas.

Where it runs

Both lanes. By default the lab runs it in your own browser over the Web Crypto API, so nothing leaves your device — there is no upload, no size limit and no queue. The server lane is there when you want it, and it is the only way an agent or a script can reach the same engine.

What the cost buys

A key-derivation function exists to be SLOW. Its cost parameters are how much work an attacker must repeat for every guess, so raising them raises the price of a dictionary attack directly. They are stored in the file, so a file encrypted with an unusual cost still opens with nothing but the passphrase — which is the reason the container format had to record them rather than assume them.

Try it

Open the lab, choose this, and raise its cost. You will feel the derivation take longer, and that time is what an attacker pays for every guess they make. The lab is a Leumas membership away; everything on this page is free.