Argon2 Hash Generator
Generate a salted Argon2id hash for storing a password.
How to use the Argon2 Hash Generator
- Enter the password you want to hash.
- Leave the variant on Argon2id unless you have a specific reason not to.
- Click Generate and copy the hash into your database.
About the Argon2 Hash Generator
Argon2 won the Password Hashing Competition in 2015 and was designed by Alex Biryukov, Daniel Dinu and Dmitry Khovratovich. It comes in three variants. Argon2d is data-dependent — the fastest, but its memory access pattern depends on the password, which can leak timing information. Argon2i is data-independent and resists side-channel attacks. Argon2id is a hybrid of the two and the generally recommended choice; it is what OWASP recommends for new applications, and it is the default here.
The headline property is that Argon2 is memory-hard. It deliberately consumes a large block of RAM while hashing, and that is the whole point: a GPU or ASIC can pack in enormous numbers of tiny parallel cores, but it cannot cheaply give every one of them 64 MB of fast memory. Attacking Argon2 therefore costs real hardware money in a way that attacking a fast hash does not. This is the key advantage over bcrypt, which is slow but not especially memory-hungry.
Like bcrypt, Argon2 salts every hash automatically, so the output differs every run and that is correct — the salt and all the parameters are encoded into the $argon2id$… string itself, which is why a verifier can read them back out later. Never check a password by re-hashing and comparing strings; use our verifier instead. This tool uses a fixed 64 MB memory cost, 4 iterations and 1 thread, because it is a public endpoint and unbounded parameters would be an easy way to knock the server over. On your own server, tune the cost to your hardware.
Frequently asked questions
Why is the hash different every time I click Generate?
Because Argon2 adds a fresh random salt to every hash. This is intentional and is exactly what you want — it stops attackers precomputing rainbow tables. Both hashes are valid for the same password. To check a password, use a verifier rather than comparing strings.
Argon2id, Argon2i or Argon2d?
Argon2id. It is the hybrid of the other two and the choice OWASP recommends for new applications. Pick Argon2i only if you specifically need the data-independent variant.
Argon2 or bcrypt?
Argon2id is the current recommendation, mainly because it is memory-hard and so makes GPU and ASIC cracking far more expensive. bcrypt is still a solid, extremely well-tested option and is supported almost everywhere, so an existing bcrypt setup is not an emergency.
Can I change the memory cost or iterations?
Not here — they are fixed at 64 MB, 4 iterations and 1 thread because this is a public endpoint. In your own code you can and should tune them; the parameters are stored inside the hash string, so a hash made here still verifies anywhere.
Is my password stored?
No. It is sent to our server to be hashed, because browsers cannot compute Argon2, then hashed and discarded immediately — never logged, never stored. For a live production password, generating it on your own server is still the safest habit.