About the Argon2 Hash Generator
Argon2 won the Password Hashing Competition in 2015 and is the algorithm most current guidance recommends for new password storage. Its Argon2id variant, used here, is memory-hard: it deliberately uses a large amount of RAM, which makes attacks with custom hardware such as GPUs and ASICs far more expensive than against bcrypt. This tool generates an Argon2id hash with a random salt, in the standard encoded format that records all parameters.
Two settings control the cost: memory (how much RAM per hash) and iterations (how many passes). Higher values are more resistant to cracking but slower and heavier on your server. 64 MB with three iterations is a reasonable starting point. The salt is random, so each run gives a different valid hash.
As with all password tools here, use test values, not real credentials, and set real passwords inside your application. Bcrypt remains a solid, widely supported choice in the Bcrypt tool.
How to use
- Type a test password.
- Choose memory and iterations for your server's capacity.
- Copy the encoded hash, which includes all parameters.
Common questions
- Argon2 or bcrypt?
- Argon2id is the current recommendation for new systems because it is memory-hard. Bcrypt is still safe and more widely supported by libraries.
- What do memory and iterations do?
- Memory sets RAM per hash; iterations set the number of passes. Both raise cost for attackers and for your server.
- Do I store the parameters separately?
- No. The encoded output includes the variant, memory, iterations and salt.
- Which variant is used?
- Argon2id, the recommended hybrid of Argon2i and Argon2d.