Generate and verify secure password hashes using Argon2id - the winner of the Password Hashing Competition.
PHC Competition WinnerArgon2id combines benefits of both i and d variants.
Default: 64 MB
Default: 3
Threads to use
Default: 32 (256-bit)
Paste the full hash string including the $argon2 prefix.
Enter the password and hash to verify.
Argon2 is a key derivation function that won the Password Hashing Competition (PHC) in 2015. It provides superior defense against GPU cracking attacks and is recommended by OWASP.
| Variant | Best For | Description | Recommendation |
|---|---|---|---|
| Argon2id | General password hashing | Hybrid approach: uses Argon2i for first half, Argon2d for second half | Strongly Recommended |
| Argon2i | Side-channel attack resistance | Data-independent memory access pattern | Specialized Use |
| Argon2d | Cryptocurrency mining | Data-dependent memory access, faster but vulnerable to side-channel | Limited Use |
| Use Case | Memory (m) | Iterations (t) | Parallelism (p) |
|---|---|---|---|
| Minimum Security | 19 MB | 2 | 1 |
| Standard (Default) | 64 MB | 3 | 1 |
| High Security | 1 GB | 4 | 4 |
Performance Note: Higher memory and iteration values provide better security but increase computation time. The default values (64MB, 3 iterations) take approximately 0.5-1 second on modern hardware.
Argon2 hashes use the PHC (Password Hashing Competition) string format:
$argon2id$v=19$m=65536,t=3,p=1$c2FsdHNhbHRzYWx0c2FsdA$WxK8SDVyNpCThLlC...
Structure:
|-- $argon2id = Algorithm (argon2id, argon2i, or argon2d)
|-- $v=19 = Version (19 = 0x13)
|-- $m=65536 = Memory in KB (64 MB)
|-- ,t=3 = Time cost (iterations)
|-- ,p=1 = Parallelism (threads)
|-- $c2Fsd... = Salt (Base64 encoded)
+-- $WxK8S... = Hash (Base64 encoded)
// Node.js with argon2 package
const argon2 = require('argon2');
// Hash a password
const hash = await argon2.hash('myPassword', {
type: argon2.argon2id,
memoryCost: 65536, // 64 MB
timeCost: 3, // 3 iterations
parallelism: 1
});
// Verify password
const isValid = await argon2.verify(hash, 'myPassword');
console.log(isValid); // true