Which Argon2 variant should I use?

Argon2id is the default recommendation: a hybrid that resists both GPU and side-channel attacks. Use Argon2i only for side-channel-sensitive scenarios without password hashing, and Argon2d when side channels aren't a concern (e.g. cryptocurrencies).

What parameters does OWASP recommend?

Argon2id with m=19456 (19 MiB), t=2 iterations, p=1 parallelism, and a 16-byte salt is the 2023 OWASP minimum. Increase memory cost first when tuning for higher security.

Is the hash computed locally?

Yes. Argon2 runs in your browser via WebAssembly. Your password never leaves the page.

argon2id · owasp recommended · noble · on-demand

Hash passwords with Argon2id

Argon2id is the OWASP-recommended algorithm for password storage — memory-hard, side-channel resistant, and the winner of the 2015 Password Hashing Competition. Runs entirely in your browser.

Argon2 Generator

Password

28 B

28 chars

Cost

m=65536

t=3 p=4

Hash

—

32 B

Status

idle

noble

input · password

output · argon2id hex

—

Quick Start

How Argon2id works

Argon2id mixes a memory matrix that depends on both the password and the addresses, combining data-dependent and data-independent passes for side-channel resistance.

01
Enter password & salt
Salt must be at least 8 bytes. 16 random bytes is recommended.
Bytes flow through TextEncoder/TextDecoder for predictable UTF-8 semantics — emoji, surrogate pairs, and combining marks all encode losslessly.
inputUTF-8TextEncoderlosslesslive
input · raw bytespw+salt · UTF-8
```
p / salt
```
loaded · UTF-8MIME · ready
02
Pick m, t, p
OWASP 2024 defaults: m=65536 KiB (64 MiB), t=3 iterations, p=4 parallelism.
Hash and signature operations call crypto.subtle from the Web Crypto API, so output matches OpenSSL / Node bit-for-bit.
costWeb Cryptosubtledeterministiclive
cost · optionsm=64MiB · live
```
t=3 p=4
```
options applied · livelive
03
Run Argon2id
Hashing is on-demand because it can take a second. Click the button to start.
Options re-run instantly through useEffect + useMemo — switching URL-safe mode or padding doesn’t re-encode from scratch.
runmemoisedoptionsinstantreactive
run · encodedgo · ready
```
processing…
```
encoded · livelossless
04
Copy or download
One click to clipboard. Download as .txt.
Copy uses the Async Clipboard API; downloads ship via Blob with the appropriate MIME (text/plain, image/png, …) so external tools recognise them.
exportclipboardblobMIME-correctclient-side
ok · copiedready · done
```
Copied
```
shipped · ready to shipsuccess

Pro tips

Encoding without surprises

Always UTF-8 first

Use TextEncoder / TextDecoder for bytes ↔ string conversion. btoa alone breaks on non-ASCII.

URL-safe vs standard Base64

Standard uses +, /, =; URL-safe swaps to -, _, no padding. Don’t mix them.

Hashes aren’t passwords

SHA-256 is fast; that’s good for fingerprints, bad for passwords. Use bcrypt / argon2 for credentials.

Watch padding rules

Some decoders are strict about = padding, others auto-pad. If round-trips fail at exactly 1 or 2 bytes, check padding.

Use Web Crypto for keys

Generate cryptographic keys via crypto.subtle, never Math.random. The latter is predictable.

JWT decode ≠ verify

Decoding a JWT just splits and base64-decodes. Verification needs the issuer’s public key / shared secret.

Use Cases

When to use Argon2id

The current OWASP-recommended choice for password hashing.

Password storage

Resistant to GPU, FPGA, and side-channel attacks. Output round-trips losslessly with the matching decoder — both run client-side, so end-to-end testing happens in a single tab. Encoding flows through TextEncoder for predictable UTF-8 semantics.

RFC-compliant

KDF for backups

Derive a backup key from a long passphrase. Web Crypto's subtle.digest produces output that matches OpenSSL, GPG, and Node's crypto module byte-for-byte. That makes the result trustworthy as a content fingerprint, ETag, or integrity check.

OpenSSL-matched

Disk encryption

Used by LUKS2 to derive volume keys. Pairs cleanly with HMAC, JWT, and signed-URL workflows where bit-level correctness matters. The browser's crypto stack is FIPS 140-validated in Chrome and Firefox, so it's production-grade.

lossless

Vault unlock

Modern password managers use Argon2id. Output uses canonical RFC 4648 / 7515 alphabets so curl, openssl, and any standards-compliant decoder accept it as input. URL-safe variants drop padding for tokens that travel in query strings.

byte-identical

End-to-end encryption

Bind keys to a user-chosen passphrase. Heavy hashing runs through useMemo so large inputs don't block typing. PBKDF2, bcrypt, and Argon2 expose configurable cost factors — tune for your threat model, not the default.

e2ee

Test fixtures

Match RFC 9106 test vectors exactly. Same input plus same options always yields identical bytes. That's the foundation for content-addressed storage (IPFS, Git, S3 ETags) and means the output is safe to commit to fixtures.

production-ready

FAQ

Frequently asked questions

Argon2id vs Argon2i vs Argon2d?

Argon2id is a hybrid: data-independent on the first half (side-channel safe) and data-dependent on the second (GPU-resistant). It is OWASP's pick.

What do m, t, p mean?

m is memory in KiB, t is iterations (time cost), p is parallel lanes. Memory ≈ m KiB; raise m until hashing takes ~250 ms on your slowest server.

Why is hashing on-demand?

With OWASP defaults Argon2id can take 250–500 ms. Running it on every keystroke would freeze the page.

Why does the salt need 8 bytes?

RFC 9106 mandates a minimum salt length of 8 bytes. 16 random bytes is standard practice.

Is anything sent to a server?

No. Argon2id is computed in your browser via @noble/hashes and runs locally.

Suggest a tool

Something missing?

Tell us what you need. We ship the top requests every two weeks.

47 in queue·8 shipped this month

Request queued. Thanks!