Micro Tools
Advertisement

Argon2 password hasher

Hash passwords with Argon2, the Password Hashing Competition winner. Tune memory, iterations and parallelism; output uses the standard encoded format.

Hash a password

Argon2id with tunable memory, time and parallelism. Output uses the standard encoded format.

Memory hardness is the main GPU defense. 65536 KiB = 64 MiB.
The Argon2 WebAssembly module loads from a CDN on first use (a second or two), then runs at near-native speed. Nothing is uploaded.
Argon2

The encoded hash appears below, e.g. $argon2id$v=19$m=...,t=...,p=...$salt$hash.

-
Advertisement

Memory-hard winner

Argon2 won the 2015 Password Hashing Competition and is OWASP's recommended password hash. Unlike bcrypt, it is memory-hard: it forces the attacker to use large amounts of RAM per guess, which defeats GPU and ASIC cracking rigs far more effectively than CPU time alone. Argon2id blends the data-independent Argon2i and data-dependent Argon2d for balanced protection.

Parameter guidance

OWASP suggests for Argon2id: 19 MiB memory, 2 iterations, 1 lane for interactive logins, or 64 MiB with 3 iterations for higher security. More memory beats more iterations against hardware attackers. The encoded output embeds all parameters, so verification needs only the string. Note this page loads a WebAssembly build on first use, which needs a moment.

Related tools

JSON formatterFormat and validate JSON, privately. Regex testerTest regex live with highlighting. Base64 encoderBase64 encode and decode, plus URL encoder and JWT decoder.

Argon2 Hash FAQs

Argon2d vs Argon2i vs Argon2id?
Argon2d is fastest but leaks via cache timing; Argon2i is side-channel safe but weaker to tradeoff attacks; Argon2id mixes both and is the recommended default.
What parameters should I use?
OWASP's baseline for Argon2id is memory 19456 KiB, iterations 2, parallelism 1. Raise memory first if your server can spare it; this demo defaults to lighter values for browser comfort.
What does the output look like?
The modular crypt format: $argon2id$v=19$m=65536,t=3,p=4$salt$hash, embedding version, parameters, salt and hash in one string.
Why is the first hash slow?
The page downloads and compiles a WebAssembly module on first use (a second or two), then hashes at near-native speed.
Is my password uploaded?
No. Everything, including the WebAssembly computation, runs locally in your browser.
Advertisement