Argon2 Hash
Generate Argon2 password hashes with configurable parameters
Input
About this tool
Argon2 is the winner of the Password Hashing Competition and is considered one of the most secure modern algorithms for hashing passwords, designed to resist both brute-force and specialized hardware attacks (like GPU cracking). This tool generates and verifies Argon2 hashes for testing or learning purposes.
How to use this tool
- Enter a sample passwordUse a test value (not a production secret) so you can safely experiment with hashing parameters.
- Set Argon2 parametersTune memory cost, time cost, and parallelism to match your security and performance target.
- Generate hash and verifyCreate an Argon2 hash, then test verification to confirm the same input validates correctly.
- Copy into your auth stackUse the generated settings as a baseline for your backend implementation and benchmark there.
Choosing Argon2 parameters
Use Argon2id for passwords - it is the variant recommended by OWASP and RFC 9106. The memory cost is how much RAM each hash uses, the time cost is the number of passes, and parallelism is the number of threads. More memory is what makes GPU cracking expensive.
OWASP suggests starting with at least 19 MiB of memory, 2 iterations and 1 degree of parallelism, then raising memory as far as your servers can afford.
Key features
- Tests modern password hashing with memory-hard protection against GPU attacks.
- Lets you see how parameter tuning affects real-world hashing cost.
- Supports both generation and verification in one workflow.
- Useful for developers migrating from BCrypt to Argon2id.
Common uses
- Evaluating secure password-hash defaults for a new authentication system.
- Comparing Argon2 parameter sets before deploying to production.
- Teaching security teams why memory hardness matters in password storage.
- Validating existing Argon2 hashes during migration or incident review.
Tips for better results
- Prefer Argon2id for general-purpose password storage unless your policy requires a different variant.
- Benchmark on your production-like hardware before finalizing parameters.
- Store algorithm + parameters with each hash so future verification remains stable.
- Use a separate random salt per password; never reuse salts across users.
Mistakes to avoid
- Setting memory cost too low, which removes much of Argon2's hardware-resistance advantage.
- Treating one benchmark from a laptop as production-ready security tuning.
- Using Argon2 as encryption instead of password hashing.
- Pasting real credentials into testing tools during experimentation.
Frequently asked questions
Both are designed to be slow/resistant to brute-force attacks, but Argon2 is newer and specifically tunable for memory usage as well as time cost, making it more resistant to attacks using specialized hardware like GPUs, which is why many modern systems prefer it over BCrypt.
They control how much computing resources are required to compute the hash - higher values make it slower and more resource-intensive to brute-force, at the cost of also being slower for legitimate use.
Hashing runs in your browser, but avoid pasting real production passwords into any third-party tool as a general precaution - use test values when exploring how Argon2 behaves.
Argon2d resists GPU cracking best, Argon2i resists side-channel attacks, and Argon2id combines both. Argon2id is the variant recommended for password hashing by OWASP and RFC 9106.
OWASP's guidance includes Argon2id with 19 MiB of memory, 2 iterations and parallelism 1 as a minimum. Measure on your own server and raise memory first, aiming for a hash time your login endpoint can absorb under load.
An Argon2 string such as $argon2id$v=19$m=19456,t=2,p=1$... stores the variant, version, memory, time, parallelism and salt. Verification reads them back, so you can change settings for new hashes without breaking old ones.