What it does
The Password Hasher creates and checks password hashes with Argon2id, bcrypt, scrypt or PBKDF2, using OWASP's recommended settings by default. It is useful for seeding test users, checking that a stored hash matches a password, or comparing algorithms and costs.
How to use it
Hash a password
- Choose the algorithm. Argon2id (recommended) is the default.
- Adjust the cost settings if you need to, or click OWASP defaults.
- Enter the password and click Hash. The result is a standard string such as
$argon2id$v=19$m=19456,t=2,p=1$….
Verify a password
- Paste the stored Hash (
$argon2id$…,$2b$…,$scrypt$…or$pbkdf2-sha256$…). The algorithm and settings are read from the hash. - Enter the password and click Verify: Password matches this hash or Password does not match.
OWASP defaults
| Algorithm | Default |
|---|---|
| Argon2id | 19 MiB memory, 2 passes, 1 lane |
| bcrypt | cost 10 |
| scrypt | N = 2¹⁷, r = 8, p = 1 (128 MiB) |
| PBKDF2-SHA256 | 600,000 iterations |
| PBKDF2-SHA512 | 210,000 iterations |
Good to know
- Every hash includes a random salt, so hashing the same password twice gives different strings. Both still verify.
- bcrypt only uses the first 72 bytes of a password.
- Use PBKDF2 only where a standard such as FIPS requires it; Argon2id resists GPU attacks far better.
- Test with sample passwords. A real user's password should never leave your systems, even into a tool that runs locally.
FAQ
Which algorithm should I choose for a new app? Argon2id, if your platform supports it. Otherwise bcrypt with cost 10 or more.
Is hashing the same as encryption? No. A hash cannot be turned back into the password; you can only check a guess against it. For reversible protection use Encrypt / Decrypt.