Password Hash Generator
Hash a password with Argon2id, bcrypt, scrypt, or PBKDF2 — with OWASP-recommended parameters — and verify a password against a hash, entirely in your browser.
Prefer the terminal? See the CLI equivalent →About the Password Hash Generator
- Argon2id · bcrypt · scrypt · PBKDF2
- Verify a password against a hash
- OWASP-recommended defaults
- Instant results
- 100% private — runs in your browser
- Free, no sign-up
Passwords must be stored as a slow, salted, one-way hash — never in plain text and never with a fast general-purpose hash like MD5 or SHA-256, which modern hardware can brute-force billions of times per second. This tool generates a proper password hash with one of the four algorithms security professionals actually use — Argon2id, bcrypt, scrypt, and PBKDF2 — and can verify a password against an existing hash.
Everything runs locally in your browser using WebAssembly (hash-wasm); the password never leaves your device, is never logged, and is never saved. A fresh random salt is generated for each hash, and the parameters follow OWASP’s current recommendations. The result is an encoded string that embeds the algorithm, parameters, and salt, so it can be stored and later verified on its own.
A crucial caveat: hashing in the browser is for learning, experimenting with parameters, and generating one-off hashes (for example, seeding an admin account). It is not an authentication mechanism — real logins must hash on the server, because a hash computed on the client simply becomes the new secret an attacker can replay.
How to use it
- Choose an algorithm — Argon2id is the recommended default for new systems.
- Enter the password (use the eye toggle to reveal it) and, if needed, adjust the parameters or salt.
- Click Generate — the encoded hash appears with the time it took, so you can tune the cost to roughly 250–500 ms.
- To check a password, switch to Verify, paste a hash, enter the password, and click Verify — the algorithm is detected automatically.
Choosing an algorithm
- Argon2id
- Memory-hard winner of the Password Hashing Competition. OWASP’s first choice for new systems.
- bcrypt
- Battle-tested and available everywhere. Note the 72-byte input limit.
- scrypt
- Memory-hard, older than Argon2. A good alternative when Argon2 isn’t available.
- PBKDF2
- NIST/FIPS-approved but not memory-hard — use it when compliance requires it, with a high iteration count.
OWASP parameters (2024)
- Argon2id
- m = 19 MiB, t = 2, p = 1 (raise the memory as your hardware allows).
- bcrypt
- Work factor ≥ 10 (12 is a common choice).
- scrypt
- N = 2¹⁷, r = 8, p = 1 for production (lowered here by default for browser responsiveness).
- PBKDF2
- 600,000 iterations with SHA-256, or 210,000 with SHA-512.
Frequently asked questions
Is my password sent anywhere?+
No. Hashing and verification run entirely in your browser via WebAssembly — there is no server, nothing is uploaded, and the password is never logged or saved. You can confirm it works offline.
Can I use this to hash passwords for my app’s login?+
Not directly. Password hashing for authentication must happen on the server: if the client sends a hash, that hash becomes the effective password an attacker can replay. Use this tool to learn, tune parameters, or generate a one-off hash (e.g. to seed an admin user), and hash on the server in production.
Which algorithm should I choose?+
Use Argon2id for new systems. Choose bcrypt when you need the broadest library support, scrypt as a memory-hard alternative, and PBKDF2 when FIPS/NIST compliance is required. All four are configured with sensible defaults here.
Why does the tool show how long hashing took?+
Password hashes are meant to be slow. A good target is roughly 250–500 ms on your server hardware — slow enough to frustrate brute-force attacks, fast enough for real logins. The timing readout lets you raise the cost parameters until you hit that range.
What format is the output?+
Argon2 and bcrypt use their standard encoded strings ($argon2id$… and $2b$…). scrypt and PBKDF2 have no single universal format, so the tool wraps them in a self-describing string that embeds the parameters and salt ($scrypt$… and pbkdf2_…), which the Verify mode understands.
Related tools
ASN.1 Decoder
Decode ASN.1 DER/BER — paste PEM, Base64, or hex and see the tag–length–value tree behind X.509 certificates, keys, and CMS, entirely in your browser.
Certificate Decoder
Decode X.509 / PEM certificates — view subject, issuer, validity, SANs, key, and fingerprints, all in your browser.
Hash Generator
Compute MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes of text or a file, plus HMAC — all at once, entirely in your browser.
JWT Debugger
Decode and inspect JSON Web Tokens: view the header and payload, check expiry, and verify HS/RS/PS/ES signatures — all in your browser.
JWT Signer
Build a JWT header and payload and sign it with HMAC (HS256/384/512) or an RSA/ECDSA private key (RS/PS/ES) — entirely in your browser. Nothing is uploaded.
Metadata Inspector
Inspect the hidden metadata in a photo or document — EXIF, GPS location, author, dates, and more — right in your browser. Download a cleaned copy with the metadata removed.