scrypt
A key derivation function from 2009 by Colin Percival, originally for the Tarsnap backup service. The first one deliberately made memory-hard — guessing passwords should cost RAM, not just computation.
The background is that bcrypt and PBKDF2 mainly cost processor time, and processor time is cheap to scale with GPUs and custom chips. scrypt forces the attacker to hold a large table in memory for each parallel guessing attempt, which makes thousands of concurrent attempts expensive in silicon rather than in clock cycles. The parameters N (memory/cost), r (block size) and p (parallelism) are tuned to what the server can bear. Standardized in RFC 7914. Litecoin adopted it as a mining algorithm precisely for ASIC resistance — and got ASICs anyway. Argon2, winner of the 2015 Password Hashing Competition, is today's recommendation, but scrypt remains perfectly acceptable.