How an OPRF protocol can stop attackers from cracking stolen password databases

When a user database is stolen, even strong password hashing with Argon2id offers limited protection because attackers can run unlimited offline cracking attempts using rented GPUs and leaked password lists. A 'pepper' — a secret key mixed into the hash — partially helps but is often stored on the same server and cannot be rotated without invalidating all hashes. An Oblivious Pseudo-Random Function (OPRF) addresses this by keeping the secret on a separate service, ensuring that without contacting that service, no offline attack is possible. The verifiable variant (VOPRF, RFC 9497) adds cryptographic proof that the correct key was used, preventing a compromised server from silently substituting its own key. However, the security guarantee only holds if the client's reference public key is obtained through an independent, out-of-band channel rather than from the same server being verified.