Verify a password against an Argon2 PHC hash using the parameters embedded in the hash.
Runs in your browser — your input is processed on this device and never uploaded.
Results appear here.
Verification takes a password and an encoded Argon2 hash and answers whether they match.
The result is valid or invalid.
Password hashing parameters are supposed to increase over time as hardware improves, which means a real database ends up holding hashes made under several different settings. If the parameters lived in your configuration rather than in the hash, raising them would invalidate every existing record at once.
Self-describing hashes solve that. Each one is verified on its own terms, old and new side by side, and you can re-hash a password with stronger settings the next time its owner logs in.
Argon2id Hash Generator produces the hashes this checks.
Comparing hash strings directly is not a substitute and will always fail, because the salt differs on every generation. The same password legitimately produces a different string each time, so verification has to recompute rather than compare.
Reading parameters from untrusted input is a hazard in itself. A hostile PHC string can specify enormous memory and time costs, and a verifier that trusts them will happily try to allocate gigabytes. This tool bounds the resource parameters before computing anything, so a malicious hash cannot exhaust the browser.
An invalid result does not distinguish a wrong password from a corrupted or malformed hash, which is deliberate. Verification endpoints that explain why they failed tend to explain more than they intended.
Find similar tools by category or tag.