bcrypt work factor versus salted SHA-256 for cross-platform R authentication

Goal

Select a password-hashing strategy for an R Shiny application that must run on Linux, Windows, and macOS without requiring compiled dependencies.

Constraints

• bcrypt via the bcrypt or openssl package provides adaptive cost but may need compilation on some platforms, and default work-factor values differ across package versions.
• SHA-256 is available in base R via openssl::sha256 or digest, yet it requires explicit per-user salt generation and storage to resist precomputed attacks.
• Authentication latency must stay below 200 ms per login under typical load.

Uncertainty

Documentation does not clarify whether a fixed SHA-256+salt implementation with a 16-byte random salt per user meets the same threat model as bcrypt with a cost factor of 10 when both are deployed in pure R environments.

Which approach offers a clearer upgrade path if the threat model changes? How should the salt be stored and versioned alongside the hash? What verification steps confirm that the chosen method behaves identically across the three target operating systems?