About this tool
The Argon2 Password Hash Generator & Verifier computes and checks Argon2 hashes entirely in your browser. Argon2 won the 2015 Password Hashing Competition and is standardised in RFC 9106; unlike bcrypt it is memory-hard, meaning its cost is dominated by RAM usage, which frustrates GPU and ASIC cracking rigs. Generate mode draws 16 random salt bytes from crypto.getRandomValues and runs the selected variant with your parameters: t iterations (time cost), m memory in KiB, p parallelism (lanes), and the output hash length in bytes.
Three variants are offered. Argon2id (the default and the RFC-recommended choice) is a hybrid that resists both side-channel and time-memory trade-off attacks; Argon2i is optimised against side-channel leakage; Argon2d maximises resistance to GPU cracking but is not side-channel safe. The result is a self-describing PHC string of the form $argon2id$v=19$m=65536,t=3,p=1$<base64 salt>$<base64 hash>, so every parameter needed to verify travels inside the hash. The defaults (t=3, m=65536 KiB = 64 MiB, p=1) follow the RFC 9106 second recommended profile.
Because the work runs as an eval-free WebAssembly build under the browser's strict security policy, memory is allocated in-page: very high m values are RAM-intensive and can be slow on phones, so the tool warns above 256 MiB. Verify mode parses the variant, version, m/t/p, salt, and digest from an encoded hash, recomputes with the candidate password, and reports match or no-match. Passwords are hashed 100% in your browser and nothing is uploaded.