🧂 Password Hash

Hash and verify passwords with bcrypt, scrypt and Argon2.

Password

Algorithm

Memory (KiB) Iterations (t) Parallelism (p) Hash length

Salt (hex, optional — random if empty)

Choosing parameters

Password hashes are deliberately slow and (except bcrypt) memory-hard, so guessing is expensive. OWASP suggests Argon2id with 19 MiB memory, 2 iterations and parallelism 1, or scrypt with N = 2¹⁷, r = 8, p = 1, or bcrypt with cost 10 or more. bcrypt only uses the first 72 bytes of a password. Argon2 and bcrypt produce standard strings that include the parameters and salt; scrypt uses the PHC-style $scrypt$ln=…,r=…,p=…$salt$hash format (base64 without padding).