Argon2 Verify
Check whether a plaintext password matches a stored Argon2 hash.
Verify a password against an Argon2id, Argon2i, or Argon2d hash in your browser. Free, offline, runs entirely client-side. Read more Show less
What is Argon2 verify?
Argon2 verify takes a plaintext password and an Argon2 hash, re-derives the hash using the parameters embedded in the stored value, and checks whether the two match. It is the login check that every modern web framework performs when Argon2 is used to protect passwords.
Argon2 is the winner of the Password Hashing Competition (2015) and the current recommendation from OWASP and NIST for new applications. It is memory-hard, resistant to GPU and ASIC attacks, and has a standard PHC hash format that embeds everything needed to verify.
How to verify
Paste the Argon2 hash and type the password you want to check. The tool auto-detects the variant (Argon2id, Argon2i, or Argon2d), reads the parameters from the hash, re-derives, and compares.
The standard PHC format is:
$argon2id$v=19$m=65536,t=3,p=4$<salt-b64>$<hash-b64>
The parameters:
v - version. 19 = 0x13 is the current standard.
m - memory cost in KiB. m=65536 means 64 MB. Typical values: 19456 (19 MiB, OWASP minimum), 47104 (46 MiB), 65536 (64 MiB).
t - time cost (iterations). Typical value: 2-4.
p - parallelism (lanes). Typical value: 1-4.
Variants
Argon2id - hybrid. Resistant to both side-channel and GPU attacks. This is the default and the right choice for password hashing.
Argon2i - optimized for resistance to side-channel attacks, at the cost of weaker GPU resistance. Used in some cryptocurrency applications.
Argon2d - optimized for GPU resistance, at the cost of side-channel resistance. Not recommended for password hashing.
This tool reads the variant from the hash prefix and uses it automatically. You do not need to choose.
FAQ
Why does verification take a moment?
Argon2 is designed to be slow and memory-hungry. The parameters embedded in the hash (m, t, p) control how slow. A typical Argon2id hash with m=65536, t=3 takes 100-300ms and 64MB of RAM to verify. That is the design - an attacker trying billions of guesses must pay the same cost each time.
What is the difference between Argon2id, Argon2i, and Argon2d?
They use the same core function but different patterns for memory access. Argon2d reads memory in a data-dependent order, which makes it fast against GPU but vulnerable to timing attacks. Argon2i uses data-independent access, resisting side-channel but slightly weaker against GPU. Argon2id is the hybrid - data-dependent for the first half, data-independent for the second - and is the recommended default. For password hashing, use Argon2id.
Can I verify an Argon2 hash if I only have the encoded string?
Yes. That is exactly what this tool does. The PHC format carries everything: the variant, version, parameters, salt, and the reference hash. No separate inputs are needed.
Is it safe to paste my Argon2 hash here?
This tool runs entirely in your browser. Nothing is uploaded. You can verify by opening your browser's Network tab and confirming no requests are sent after page load.
My hash does not start with $argon2
It may be a wrapped format or a raw binary hash. Common alternatives are bcrypt ($2b$...) and scrypt ($scrypt$...). If it looks like a hex string with no wrapper, it was likely produced without PHC encoding - use the appropriate wrapper's library to verify in that case.
Does the memory parameter affect how long verification takes?
Yes. Argon2 allocates m KiB of memory and performs t passes over it. Doubling m roughly doubles the time; doubling t doubles the time; increasing p does not usually speed up wall-clock time on a single CPU but does on multi-core machines.
Why does my Argon2 hash verification fail even though the password is correct?
Two common reasons: (1) the hash was truncated during copy-paste; (2) the password contains trailing whitespace that is not in the source. Compare the exact bytes - a trailing newline in the hash string will cause a mismatch.
Command line equivalent
# Node with argon2
npm i argon2
node -e '
const argon2 = require("argon2");
const hash = "$argon2id$v=19$m=65536,t=3,p=4$...";
argon2.verify(hash, "hunter2").then(ok => console.log(ok ? "match" : "no match"));
'
# Python with argon2-cffi
pip install argon2-cffi
python3 -c '
from argon2 import PasswordHasher
ph = PasswordHasher()
hash = "$argon2id$v=19$m=65536,t=3,p=4$..."
try:
ph.verify(hash, "hunter2")
print("match")
except Exception:
print("no match")
'
# Command line (any Unix with Argon2 reference implementation)
echo -n "hunter2" | argon2 salt -id -m 16 -t 3 -p 4 -e