Argon2 Hash + Verify

Argon2 is the Password Hashing Competition winner and the algorithm recommended in RFC 9106 for hashing passwords. Unlike bcrypt, it deliberately demands a lot of memory, not just CPU time, which makes attacks on specialized hardware (GPUs, ASICs) much harder.

How to use it

• Hash: enter a password, pick a variant (Argon2d, Argon2i, or Argon2id), and set the parameters (memory, iterations, parallelism) to get a hash.
• Verify: paste a password and an existing Argon2 hash to check whether they match, without hashing manually yourself.
• Argon2id is the recommended default for most applications — it combines the strengths of Argon2i and Argon2d.

Common uses

• Checking that a backend generates correct Argon2 hashes with the expected parameters before a release.
• Tuning memory and iteration parameters to fit within a server's response-time budget (typically 250-500ms).
• Comparing Argon2 against bcrypt or PBKDF2 when choosing an algorithm for a new project.

Things to keep in mind

The memory parameter is Argon2's main defense: the more memory hashing requires, the more expensive it is for an attacker to parallelize an attack on a GPU with limited fast memory per chip.

Argon2id is recommended for most cases: Argon2i resists side-channel attacks better, Argon2d resists GPU attacks better, and id combines both approaches.