Argon2 Hash Generator
Generate Argon2id password hashes with configurable parameters.
Overview
The Argon2 hash generator produces a modern, memory-hard password hash that you can store in a database, drop into a config file, or verify against a known good value. Enter a password, tune the memory, iteration, and parallelism knobs, and receive an encoded string starting with $argon2id$ that round-trips with any compliant verifier.
It is built for backend engineers picking a password storage scheme, security reviewers comparing hash parameters, and CTF players generating test vectors. If you have been advised to "use Argon2 instead of Bcrypt" but are not sure what parameters to pick, this Argon2id password hashing tool gives you a sandbox to feel out the cost.
How it works
Argon2 won the 2015 Password Hashing Competition and is specified in RFC 9106. The default variant, Argon2id, is a hybrid of Argon2i (side-channel resistant) and Argon2d (GPU-resistant). The tool generates a 16-byte random salt, then runs Argon2id with your chosen memory cost (m, in KiB), time cost (t, iterations over the memory matrix), and parallelism (p, number of lanes). Output is encoded in the standard $argon2id$v=19$m=...,t=...,p=...$salt$hash form, which already carries every parameter needed to verify later.
Examples
Password: correct horse battery staple
m=19456 t=2 p=1
Output: $argon2id$v=19$m=19456,t=2,p=1$c29tZXNhbHQ$...
Password: hunter2
m=65536 t=3 p=4
Output: $argon2id$v=19$m=65536,t=3,p=4$...
Password: "" (empty)
Output: $argon2id$v=19$m=19456,t=2,p=1$... (still valid, just trivially crackable)
FAQ
Argon2i, Argon2d, or Argon2id?
Argon2id is the OWASP recommendation for password storage — it inherits Argon2d's resistance to GPU cracking on the first pass and Argon2i's resistance to side-channel attacks on the second. Pick it unless you have a specific reason not to.
What parameters should I use in production?
OWASP currently suggests m=19 MiB, t=2, p=1 as a sane floor, scaled up until a single hash takes ~250–500 ms on your target hardware. Higher memory cost beats higher iteration count when you can afford the RAM.
Why is the salt embedded in the output?
Argon2's PHC string format bundles the salt and parameters with the hash so you only need to store one column. A verifier reads everything back out and recomputes the digest.
Is it reversible?
No. Argon2 is a one-way function. Verification works by re-hashing the supplied password with the stored salt and parameters and comparing digests in constant time.