Argon2 Hash Generator
Hash and verify passwords with Argon2id.
About the Argon2 Hash Generator
What is an Argon2 hash?
Argon2 is the winner of the 2015 Password Hashing Competition and the algorithm most security experts now recommend for new password storage. It is memory-hard like scrypt but with a cleaner, more configurable design, and it comes in three variants: Argon2id (the recommended default), Argon2i and Argon2d. Its output is a self-contained encoded string like $argon2id$v=19$m=65536,t=3,p=4$....
You tune three costs independently: memory (how much RAM each hash needs), iterations (time cost) and parallelism (threads). Argon2id combines the side-channel resistance of Argon2i with the GPU resistance of Argon2d, which is why it is the general recommendation. This tool computes Argon2 in your browser using a vendored WebAssembly build, so it is fast and nothing is uploaded.
How to Use This Tool
- Enter the password. Type or paste the password you want to hash.
- Adjust the settings. Tune the cost parameters and salt; the hash recomputes automatically.
- Copy the result. One click copies the hash to your clipboard.
- Verify existing hashes. Switch to the Verify tab to check a password against a stored hash.
Common Use Cases
- Modern password storage: the current top recommendation for hashing user passwords in new systems.
- Verifying a login: use the Verify tab to check a password against a stored Argon2 hash.
- High-value secrets: the memory-hard design is well suited to protecting especially sensitive credentials.
- Matching PHP or other libraries: PHP's password_hash with PASSWORD_ARGON2ID produces the same encoded format.
Frequently Asked Questions
Which Argon2 variant should I use?
Argon2id for almost everything. It is a hybrid that resists both side-channel attacks (the strength of Argon2i) and GPU cracking (the strength of Argon2d), which is why it is the default recommendation and what PHP and most libraries use. Choose Argon2i or Argon2d only if a specific requirement calls for it.
What memory and iteration settings should I use?
A common baseline is 64 MB of memory, 3 iterations and a parallelism of 1 to 4. OWASP suggests at least 19 MB of memory with higher iteration counts. Raise the memory cost first, since that is what most frustrates attackers, and benchmark so logins stay comfortably fast.
Is Argon2 better than bcrypt?
For new projects, generally yes. Argon2id is memory-hard, highly configurable and was designed with modern attack hardware in mind, whereas bcrypt is older and not memory-hard. That said, bcrypt is still perfectly acceptable, and existing bcrypt hashes do not need to be rushed out.
What do the parts of an Argon2 hash mean?
An encoded Argon2 hash lists the variant (argon2id), the version (v=19), the memory, time and parallelism costs (m, t, p), then the Base64 salt and hash. Because everything is embedded, a single string is all you need to store, and verification reads the parameters straight back out.
Can I verify an Argon2 hash from PHP?
Yes. Switch to the Verify tab and paste a hash produced by PHP's password_hash with PASSWORD_ARGON2ID (or any standard Argon2 library). Enter the password and the tool tells you whether it matches.
Is the hashing done privately?
Yes. Argon2 runs in your browser via a vendored WebAssembly module. Your password and hash are never sent to a server.