Argon2 Password Hash Generator & Verifier
Hash a password with Argon2id, Argon2i or Argon2d at your own memory, time and parallelism cost, or verify one against an existing $argon2 PHC hash.
Generate an Argon2 hash
Empty, every hash draws a fresh random 16-byte salt. A salt of your own must be at least 8 bytes. To re-derive an existing hash, choose Base64 and paste its salt: the segment right after m=…,t=…,p=…$.
19456 KiB is 19 MiB. 19456 KiB (19 MiB) with 2 iterations and parallelism 1 is the OWASP-recommended minimum for Argon2id — under a second on a laptop. Higher memory makes every guess cost an attacker more RAM, and takes proportionally longer here, on your device.
Argon2 is deliberately slow and memory-hard: each guess costs an attacker both CPU time and RAM. The encoded string carries the variant, salt and all cost parameters, so it is all you need to verify later.
Verify a password against a hash
Free Argon2 hash generator & verifier — nothing uploaded
Argon2 won the 2015 Password Hashing Competition and is today's first-choice algorithm for storing passwords. This tool does the two everyday jobs: generate an Argon2 hash from a password, and verify whether a password matches an existing hash. Both run entirely in your browser with the WebAssembly build of Argon2 — no password ever leaves your device. It is the modern, memory-hard companion to bcrypt.
Why Argon2 is memory-hard
Fast hashes like MD5 or SHA-256 let an attacker try billions of guesses per second on cheap GPUs. Argon2 deliberately spends a large, tunable amount of memory as well as CPU time on every single guess, which is expensive to parallelise on GPUs and ASICs. Every hash also embeds a random salt, so the same password produces a different hash each time and can only be checked by re-running the algorithm — you cannot "decrypt" it.
Argon2id, Argon2i and Argon2d
Argon2id is the recommended default for password storage: it blends the data-independent memory access of Argon2i (resistant to side-channel timing attacks) with the data-dependent access of Argon2d (resistant to GPU cracking). Choose Argon2i only when side-channel resistance is the sole concern, and Argon2d for workloads with no untrusted side channels, such as proof-of-work.
Choosing memory, iterations and parallelism
The three cost parameters trade security against speed. Memory (in KiB) is the strongest lever — OWASP suggests at least 19456 KiB (19 MiB) with 2 iterations for Argon2id. Iterations (the time cost) is how many passes are made over that memory, and parallelism is the number of lanes. Higher values are harder to crack but slower, and because the work happens on your own device, very high memory takes a noticeable moment in the browser. Clear, at the foot of the page, empties the boxes and puts the variant, the costs, the hash length and the salt back to how the page opens; it cannot be pressed while a hash or a check is still running.
Anatomy of the encoded hash
The output is a standard PHC string such as $argon2id$v=19$m=19456,t=2,p=1$<salt>$<hash>: the variant, the version, the memory / time / parallelism costs, then the base64 salt and hash. Everything the verifier needs sits inside that one line, so you can store it as-is and check passwords against it later. Under it the page also shows the digest on its own, as hex: the hash bytes alone, without the salt or the parameters.
Private by design
Passwords are sensitive, so nothing you type is sent anywhere — hashing and verification happen locally in your browser. That is why there is no sign-up.
Frequently asked questions
Can I decrypt or reverse an Argon2 hash?
No. Argon2 is not a cipher, so nothing turns its output back into the password. Verify passes the whole $argon2… string to hash-wasm's WebAssembly Argon2, which takes the variant, memory, iterations, parallelism and salt from it, hashes your candidate and compares.
Argon2id, Argon2i or Argon2d — which should I use?
Use Argon2id for password storage; it is the recommended default and combines the strengths of the other two variants. Pick Argon2i only when resistance to side-channel timing attacks is your one concern, and Argon2d for workloads with no untrusted side channels, such as proof-of-work.
Can I set the hash length or use my own salt?
Yes. The hash length is a field of its own, and the salt box takes text, hex or Base64 — paste the salt from an existing hash and the same settings reproduce that hash exactly. Leave the salt empty and a random one is drawn.
Is there a list of recommended cost settings to start from?
Yes. The Cost preset list above the cost fields moves memory, iterations and parallelism together to a published recommendation: the OWASP minimum, which is this page’s default, and OWASP’s trade of passes for more memory; libsodium’s interactive, moderate and sensitive limits; and RFC 9106’s low-memory option. Each option spells out its MiB, iterations and parallelism. Edit any of the fields by hand and the list shows Custom (your own numbers). The larger presets take a noticeable moment in the browser.
Can I share these settings?
Yes. The variant, memory, iterations, parallelism and hash length are kept in the page address as you set them, so Copy link, beside Clear at the foot of the page, hands them on. The password and the salt are never put in it.