Memory-Hard Security

46 Megabytes to Hash
One Password.

Argon2id memory-hard hashing. Short-lived JWTs. TOTP multi-factor. Aggressive rate limiting on every endpoint.Authentication that makes brute-force economically impossible.

46 MiB
Argon2id memory
15m
JWT lifetime
6-digit
TOTP codes
5/5m
Rate limit
Explore Security
Authentication Flow

Four Steps. Zero Shortcuts.

Password
Argon2id (46 MiB)
MFA
TOTP 6-digit code
JWT Issued
Ed25519 signed
Session Active
15-min access token

Why 46 MiB?

GPUs have limited memory per core. A GPU with 10,000 cores and 24 GB VRAM can only run ~500 Argon2id hashes simultaneously at 46 MiB each. This makes brute-force attacks on passwords economically impractical.

Argon2id Parameters
47,104
KiB memory
1
Iteration
1
Parallelism
Compare: bcrypt

bcrypt has no memory-hardness parameter. A GPU can run thousands of bcrypt hashes in parallel because each uses only 4 KiB of memory. Argon2id uses 11,776x more.

password_hash.py
# Hash a password with Argon2id
from argon2 import PasswordHasher
ph = PasswordHasher(
memory_cost=47104, # 46 MiB
time_cost=1,
parallelism=1,
)
hashed = ph.hash(password)
# $argon2id$v=19$m=47104,t=1,p=1$...
# 46 MiB per hash attempt.
# GPU brute-force: economically dead.
Token Lifecycle

Short-Lived by Design

Access tokens expire in 15 minutes. If a token is stolen, the window of exploitation is minimal. Refresh tokens handle seamless re-authentication.

5 min
Partial Token
MFA step only
15 min
Access Token
API access
7 days
Refresh Token
Token renewal
30 days
Remember Me
Extended session
Scan with your authenticator app
3
1
4
1
5
9
RFC 6238 compliant. 30-second window.
Multi-Factor Auth

TOTP: Something You Have

Time-based one-time passwords add a second factor that cannot be phished remotely. The shared secret never leaves your authenticator app.

RFC 6238 compliant TOTP implementation
Compatible with Google Authenticator, Authy, 1Password
10 backup codes (each Argon2id-hashed)
QR code setup for seamless onboarding
30-second time window with clock drift tolerance
Rate Limiting

Every Endpoint. Every Limit.

Exceeding any limit triggers exponential backoff. No bypass. No exceptions.

Login
high
5 / 5 min
MFA verify
high
5 / 5 min
Password change
high
3 / 15 min
Vault search
medium
10 / min
File upload
medium
5 / min
API general
low
60 / min

Authentication That
Doesn't Compromise.

Memory-hard hashing. Short-lived tokens. Multi-factor authentication. Rate limiting on every endpoint. No shortcuts, no tradeoffs.

OWASP compliant NIST 800-63B Argon2id