Argon2 hash

Hash a password with Argon2id and get a standard PHC string, or verify a password against one. Runs in your browser — the password never leaves your device.

Result

About this tool

Argon2 hash hashes a password with Argon2id — the winner of the Password Hashing Competition and the modern, memory-hard algorithm recommended for storing passwords. The result is a standard PHC string that embeds the algorithm, parameters, salt and hash, e.g.:

$argon2id$v=19$m=19456,t=2,p=1$<salt>$<hash>

Privacy

Everything runs in your browser via WebAssembly — your password is never uploaded to a server. Also available from the gizza CLI and in chat.

Why Argon2id?

Unlike fast hashes (MD5/SHA), Argon2id is deliberately slow and memory-hard, which makes large-scale password cracking expensive. Use it (or bcrypt/scrypt) for storing user passwords — never a plain SHA.

FAQ

Why do I get a different hash every time for the same password?

That's by design. Hash mode generates a fresh random 16-byte salt on every run, and the salt is part of the PHC output — so two hashes of the same password never match. To check a password against an existing hash, use verify mode instead of comparing strings.

How do I verify a password against an existing Argon2 hash?

Switch the mode to verify, enter the password, and paste the full PHC string (everything from $argon2id$… onward) into the hash field. The memory, iteration, and parallelism parameters are read from the string itself, so you don't need to know what settings produced it. Hashes made with the argon2i or argon2d variants verify too — the algorithm is taken from the PHC string.

What parameter ranges does this tool accept?

Memory cost from 8 KiB up to 1,048,576 KiB (1 GiB), iterations 1–50, and parallelism 1–16. The defaults — 19,456 KiB (19 MiB), 2 iterations, 1 lane — follow the current OWASP recommendation for Argon2id. Raising memory is generally the most effective way to make cracking more expensive.

Is it safe to type a real password here?

The hash and verify computations run entirely in your browser via WebAssembly; the password is never sent to a server. That said, for production systems you should hash passwords server-side at the point of storage — this tool is for testing, debugging, and generating hashes you control.

Developer & Automation Access

Run it from the terminal

Same engine as this page, headless — via the gizza CLI:

gizza tool argon2-hash "The password to hash or verify"

New to the CLI? Get gizza →

Open it by URL

Pre-fill and auto-run this tool with query parameters — the names match the API/CLI:

https://gizza.ai/tools/argon2-hash/?password=The%20password%20to%20hash%20or%20verify&mode=hash&hash=%24argon2id%24v%3D19%24m%3D19456%2Ct%3D2%2Cp%3D1%24%E2%80%A6&memory_kib=19456&iterations=2&parallelism=1

Machine-readable descriptor: tool.json — title + parameters JSON Schema for agents.