crypto_argon2
Hash plaintext passwords using Argon2 KDF. Returns a PHC-encoded hash with parsed parameters and a fresh salt per call.
Instructions
Generate Argon2 Password Hash. Hash a plaintext password with the Argon2 memory-hard KDF, returning a self-describing PHC-encoded hash plus the parsed parameters and salt. A fresh random salt is generated on every call, so the same input yields a different hash each time (non-idempotent). Use this to create a new hash; use crypto_argon2_verify to check a password against an existing one. Argon2 is the recommended modern KDF — prefer it over crypto_bcrypt (no memory hardness), crypto_scrypt, and the legacy crypto_pbkdf2. Runs server-side on the input you provide: read-only, non-destructive, contacts no external service, and is rate-limited (5 requests/min, 30/hour, 100/day for anonymous callers; CAPTCHA may trigger above 20/hour). Returns the encoded hash, the variant, the m/t/p cost options, and the salt/length parsed back out.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| password | Yes | The plaintext password to hash. Required and must be non-empty. | |
| variant | No | Argon2 variant. argon2id (hybrid, recommended) resists both side-channel and GPU attacks; argon2i is data-independent only. | argon2id |
| memory | No | Memory cost in KiB (the m parameter). Higher is stronger but slower. | |
| time | No | Time cost / number of iterations (the t parameter). | |
| threads | No | Degree of parallelism / threads (the p parameter). |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| password | No | The plaintext password that was hashed (echoed from the request). | |
| hash | No | The encoded Argon2 hash in PHC format: $argon2id$v=19$m=65536,t=4,p=3$<saltBase64>$<hashBase64>. | |
| variant | No | The variant used to hash, argon2id or argon2i. | |
| variantName | No | Human-readable variant label, e.g. Argon2id. | |
| options | No | The cost parameters applied to the hash. | |
| info | No | Components parsed back out of the encoded hash. | |
| length | No | Character length of the encoded hash string. | |
| generatedAt | No | ISO 8601 timestamp of when the hash was generated. | |
| verified | No | Always true — a self-check that the generated hash verifies against the input password. |