Question 1

What's the difference between Argon2id, Argon2i, and Argon2d?

Accepted Answer

Argon2d optimizes for GPU/ASIC resistance using data-dependent memory access — strongest against parallel attacks but vulnerable to side-channel attacks (timing leaks the password). Argon2i uses data-independent memory access — side-channel resistant but slightly weaker against parallel hardware. Argon2id is a hybrid that runs Argon2i for the first half pass and Argon2d for the rest — it gets the side-channel resistance of i with the GPU resistance of d. RFC 9106 (2021) declares Argon2id the recommended default unless you specifically need one of the others.

Question 2

What are the OWASP-recommended parameters?

Accepted Answer

OWASP Password Storage Cheat Sheet (2024) recommends: Argon2id with m=19456 (19 MiB), t=2 iterations, p=1 parallelism, salt 16 bytes, output 32 bytes. For applications that can afford more resources, m=64-128 MiB is fine and improves resistance significantly. The defaults in this tool (t=3, m=65536, p=4) match a typical 2024 server profile — adjust down to OWASP minimums if you need broader compatibility (low-end hosting).

Question 3

Why is Argon2 better than bcrypt?

Accepted Answer

Bcrypt is CPU-hard but uses only ~4KB of memory per hash, so attackers can run thousands of bcrypt operations in parallel on a single GPU's RAM. Argon2 is memory-hard — at m=19 MiB, each parallel attacker needs its own 19 MiB chunk, drastically reducing throughput per dollar of attacker hardware. The Password Hashing Competition (2013-2015) specifically selected Argon2 as the winner because of this memory-hardness property. Bcrypt is still acceptable for legacy systems but new code should default to Argon2id.

Question 4

Why does this take so long?

Accepted Answer

Argon2's slowness is the point. At m=65536 (64 MiB), t=3 iterations, p=4 parallelism, each hash takes ~300ms on a modern CPU. That's the same time budget for both legitimate logins AND for the attacker's brute-force attempts. If your server CPU is 8x faster than a single GPU thread, the attacker needs 8x more GPU threads — which costs 8x more in hardware. Web Crypto can't help here because there's no native Argon2 in browsers; the WASM implementation does the heavy lifting. The tool loads the WASM on-demand to keep the initial page load fast.

Question 5

What's the encoded output format?

Accepted Answer

Argon2 produces an encoded string like `$argon2id$v=19$m=65536,t=3,p=4$$`. The fields are: variant prefix ($argon2id$/$argon2i$/$argon2d$), version (always v=19 for current Argon2 1.3), parameters (memory, time, parallelism), salt, and hash. Anyone with this encoded string can verify a password against it — they parse the parameters, re-run Argon2 with the same settings, and compare the resulting hash in constant time. The encoded format is what you store in your database; the raw hash by itself is useless without the parameters.

Argon2 Hash Generator

Frequently Asked Questions