# Argon2 Verifier

Check whether a password matches an Argon2 hash. Paste the password and a PHC string such as $argon2id$v=19$m=65536,t=4,p=1$, and the tool reads the variant, memory, iterations, lanes and salt, recomputes the hash and answers match or no match. It supports Argon2id, Argon2i and Argon2d version 19 up to 64 MiB, 4 iterations and 8 lanes, and it never echoes the password.

## Frequently asked questions

### How does Argon2 verification work?

The tool parses the PHC string to get the variant, version, memory, iterations, parallelism and salt. It then hashes your password with those exact settings and compares the result with the stored hash.

### Which hashes can I check?

The tool checks Argon2id, Argon2i and Argon2d hashes of version 19 (0x13) in the PHC string format. These are produced by PHP password_hash, libsodium, argon2-cffi, the Node.js argon2 package and the Argon2 Generator on this site.

### What are the limits?

The hash may use at most 64 MiB of memory (m=65536), 4 iterations and 8 lanes. These limits cover PHP's default of m=65536,t=4,p=1 and the argon2-cffi default of m=65536,t=3,p=4. Hashes that ask for more are refused with an explanation.

### Can I test it with a published example?

The reference implementation's test hash $argon2id$v=19$m=65536,t=2,p=1$c29tZXNhbHQ$CTFhFdXPJO1aFaMaO6Mm5c8y7cJHAph8ArZWb2GRPPc belongs to the password password with the salt somesalt. Entering both returns match.

### Why is my hash refused as invalid?

The string must start with $argon2id$, $argon2i$ or $argon2d$, then v=19, then m, t and p separated by commas, then the Base64 salt and hash. Hashes copied with spaces, quotes or a missing part are rejected. Older version 16 hashes without a v= part are not supported.

### Is my password kept secret?

Yes. The response holds only the answer and the hash you entered, never the password. Nothing is stored or logged.

### Does a no match result mean the hash is broken?

Usually it means the password differs, for example by a trailing space or a different letter case. Some systems also add a pepper or a secret key before hashing, which this verifier cannot know.

### How long does a check take?

The check costs as much as creating the hash, which is typically well under a second within the limits above. Very large memory settings are refused for that reason.

### Does this tool support libsodium hashes?

Yes, libsodium's crypto_pwhash_str writes Argon2id PHC strings. Its interactive preset uses 64 MiB and 2 iterations and verifies here, while the moderate and sensitive presets exceed the 64 MiB limit.

### Can I check bcrypt hashes here?

No. Use the Bcrypt Verifier for hashes that start with $2a$, $2b$ or $2y$.

Your ad here?

[Email us](mailto:hi@dennn.is?subject=Advertising%20on%20OneClick%20Pro)

[Ad The agent-ready plugin suite for WordPress.](https://sleekwp.com/?ref=oneclickpro)