Argon2 won the password hashing competition and is a preferred choice for new password storage systems. It uses both time and memory costs to make brute-force attacks with GPUs and specialized hardware more difficult. The tool provides separate modes for generating, verifying, and parsing hashes.
Argon2id is the recommended variant for password storage. Argon2i is intended for special scenarios requiring resistance to side-channel attacks. Argon2d is not recommended for general password storage.
The recommended preset uses 64MB of memory, t=3, and p=2. The high-security preset uses 128MB, t=3, and p=4. The low-resource preset uses 32MB, t=2, and p=1. All parameters can also be configured manually.
The main parameters are memory, iterations, and parallelism. The p value should not exceed the number of available CPU threads on the server. Presets are starting points; final parameters should be tested against the target server CPU, memory, and login concurrency.
Generation produces a standard PHC-format string containing the algorithm, version, m, t, p, salt, and hash body. The result can be stored directly in a database. The password can be shown or hidden, and a random test password can also be generated.
Enter an existing Argon2 hash and a password to verify it. The tool reads the parameters stored in the hash and recomputes the result for comparison. It reports whether the values match and does not generate a new hash.
Parse mode reads the algorithm, version, memory, iterations, parallelism, salt, and hash body from the PHC string.
The benchmark runs the current parameters repeatedly and reports average, minimum, and maximum processing times, along with tuning suggestions. The result represents only the current device and browser; the production server should be tested separately.
Memory is validated from 1 to 1024MB, iterations from 1 to 100, and parallelism from 1 to 16. Above 256MB, a warning is shown because the browser may run out of memory. Malformed PHC strings or missing salt or hash values show the reason for the error. If computation fails, reducing memory or iterations is recommended. There is no server-side fallback.
Useful for choosing a password hashing method for new projects, migrating from MD5, SHA, or bcrypt, inspecting the strength of existing PHC strings, and learning about memory-hard password hashing.
Hashing is irreversible. The tool only performs calculation, verification, and parsing. Everything runs locally through WebAssembly; passwords are neither uploaded nor stored. If the local engine is unavailable, an error is reported instead of falling back to server-side processing.
Comments 0