Argon2 Hash Generator and Verifier

Generate and verify Argon2id hashes in your browser, tune memory, time and parallelism against real timings, and read any PHC string back.

Runs locally

Everything happens in your browser. What you paste or drop here is never uploaded, logged or stored.

Password Show

Variant

Memory (KiB) 65536 KiB is 64 MiB, the RFC 9106 second recommended configuration.

Iterations

Parallelism

Hash length (bytes)

Argon2 is the one to use, and memory is why

Argon2 won the Password Hashing Competition in 2015 and is specified in RFC 9106. What makes it better than what came before is not that it is slower - anything can be made slower - but that it is deliberately memory-hard.

An attacker's advantage comes from parallelism: a GPU runs thousands of hash attempts at once, and custom silicon runs more. That works when each attempt needs almost no memory. Argon2 makes each attempt need megabytes, and memory is the one resource you cannot simply add more cores to. A GPU with 24 GB running a 64 MiB hash function can hold a few hundred attempts in flight, not a few hundred thousand.

That is why the memory parameter matters more than the iteration count, and why lowering it is the quickest way to give away the whole advantage.

Which variant

Argon2id - the answer for password hashing, and what RFC 9106 names. It is a hybrid: the first pass is data-independent, so it resists side-channel attacks, and later passes are data-dependent, so it resists time-memory trade-offs.
Argon2i - data-independent throughout. Resists side channels but is weaker against trade-off attacks.
Argon2d - data-dependent throughout, and therefore vulnerable to side-channel attacks. It exists for proof-of-work where nobody is measuring your memory access pattern. Do not use it for passwords.

Reading the timing figure honestly

Every generate here is timed, and the number is useful for exactly one thing: comparing parameter choices with each other. It is not a measurement of what your server will do. A browser tab is slower than a dedicated server process, a server under load is slower again, and the attacker's rig is faster than all of them.

The usual target is 250 ms to 1 second per hash on the hardware that will actually run it. Below that you are giving away work for free; far above it you have built a denial-of-service surface into your login endpoint, because that cost lands on every attempt including the failed ones.

Do not hash passwords in a browser for production

This page exists so you can see what parameters cost, check a hash you already hold, and read the parameters out of one somebody gave you - all without uploading either half. It is not a way to hash passwords before sending them to your server. A client-side hash is just a longer password as far as the server is concerned, and it makes the stored value directly replayable by anyone who steals the database.

Frequently asked questions

What parameters should I actually use?

RFC 9106's first recommendation is 2 GiB memory, 1 iteration, 4 lanes - which few web servers will give one login. Its second is 64 MiB, 3 iterations, 4 lanes, and that is the realistic default. OWASP's floor is 19 MiB with 2 iterations. Start at 64 MiB and tune until a hash takes about 250 ms on your hardware.

Where is the salt?

Inside the hash. The encoded string carries the variant, version, parameters, salt and hash together, so you store one value and verification reads everything it needs from it. A fresh random salt is generated for each hash here.

My browser ran out of memory.

Argon2's memory cost is real memory, and a tab cannot always get a gigabyte. That is a useful signal in itself - if a browser struggles, check what your server does under concurrent logins before deploying the same figure.

Can I verify a hash from my application?

Yes, provided it is in the standard encoded form. Paste it with the password and the parameters are read from the hash. Nothing is transmitted, which is what makes it reasonable to do with a real hash.

Is the password uploaded?

No. Argon2 runs in WebAssembly inside this page, and the library embeds its own WASM, so no request is made at any point.

References

Argon2 implementation: hash-wasm by Dani Biro, MIT licence.

Related tools

What this tool can and cannot tell you. It reports what is present in the input you provide. It cannot see anything you did not give it, and a clean result means nothing was found in that input - not that the wider system is secure.

Security guidance here follows current published sources - OWASP, MDN, the relevant RFCs, NIST, CISA, FIRST and MITRE - which are linked beside the specific claims they support.