diff --git a/api/account/common.go b/api/account/common.go
index 6be1f54..1dd98ad 100644
--- a/api/account/common.go
+++ b/api/account/common.go
@@ -2,6 +2,7 @@ package account
 
 import (
 	"regexp"
+	"sync"
 
 	"golang.org/x/crypto/argon2"
 )
@@ -21,8 +22,14 @@ const (
 	TokenSize = 32
 )
 
-var isValidUsername = regexp.MustCompile(`^\w{1,16}$`).MatchString
+var (
+	isValidUsername = regexp.MustCompile(`^\w{1,16}$`).MatchString
+	argonMtx sync.Mutex
+)
 
 func deriveArgon2IDKey(password, salt []byte) []byte {
+	argonMtx.Lock()
+	defer argonMtx.Unlock()
+
 	return argon2.IDKey(password, salt, ArgonTime, ArgonMemory, ArgonThreads, ArgonKeySize)
 }