Argon2 Hash Verifier

What is Argon2 verification?

Verification takes a password and an encoded Argon2 hash and answers whether they match.

• Password: the candidate to check.
• Argon2 PHC hash: the stored string. It carries the variant, the salt, and the cost parameters, so the verifier reproduces the original computation without being told how.

The result is valid or invalid.

Why the hash describes itself

Password hashing parameters are supposed to increase over time as hardware improves, which means a real database ends up holding hashes made under several different settings. If the parameters lived in your configuration rather than in the hash, raising them would invalidate every existing record at once.

Self-describing hashes solve that. Each one is verified on its own terms, old and new side by side, and you can re-hash a password with stronger settings the next time its owner logs in.

Are there alternatives?

Argon2id Hash Generator produces the hashes this checks.

Comparing hash strings directly is not a substitute and will always fail, because the salt differs on every generation. The same password legitimately produces a different string each time, so verification has to recompute rather than compare.

Fun facts and more info

Reading parameters from untrusted input is a hazard in itself. A hostile PHC string can specify enormous memory and time costs, and a verifier that trusts them will happily try to allocate gigabytes. This tool bounds the resource parameters before computing anything, so a malicious hash cannot exhaust the browser.

An invalid result does not distinguish a wrong password from a corrupted or malformed hash, which is deliberate. Verification endpoints that explain why they failed tend to explain more than they intended.