There should be a recommendation written in the recommendations page for what a sensible value for [security].PASSWORD_HASH_ALGO is. The default pbkdf2_hi is very CPU-bound and easily slow down individual requests by 500ms, argon2 and scrypt are more memory-bound and would still offer the equivalent security.
There should be a recommendation written in [the recommendations page](https://forgejo.org/docs/latest/admin/recommendations/) for what a sensible value for `[security].PASSWORD_HASH_ALGO` is. The default `pbkdf2_hi` is very CPU-bound and easily slow down individual requests by 500ms, `argon2` and `scrypt` are more memory-bound and would still offer the equivalent security.