PBKDF2 vs Argon2, explained for people who just want to choose a good passphrase

PBKDF2, in plain terms

Take the passphrase. Hash it. Hash the result. Hash the result again. Do that hundreds of thousands of times. Only then use the output as the key. The high iteration count is what makes guessing slow.

Argon2, in plain terms

Same idea, but also forces the computation to use a lot of memory. Special guessing hardware (ASICs, GPUs) is good at parallel hashing; being memory-hard makes those attacks much more expensive per guess.

What Elba uses and why

Elba uses PBKDF2 with 600,000 iterations, via the browser's audited WebCrypto implementation. Argon2 is stronger in principle but is not in WebCrypto and would require shipping a WASM implementation, which we chose not to do — the tradeoff is 'audited native primitive vs stronger primitive with more code to trust'. A strong passphrase makes the difference academic.

The passphrase advice

Four or five random words from a large list (diceware or similar) is the honest advice. It resists offline attack against either PBKDF2 or Argon2 for any reasonable time budget.

Questions people actually ask

Is PBKDF2 broken?

No. Slower to configure aggressively and less GPU-resistant than Argon2, but not broken.

Should I care which one my tool uses?

Care that a KDF is used with sensible parameters. Beyond that, worry about your passphrase length first.