Password Hashing Tool
Hash a password with Argon2id, bcrypt, scrypt or PBKDF2 using OWASP-recommended settings and a random salt, and verify passwords against stored hashes.
A new random 16-byte salt is generated on every click, so the hash changes each time; all of them verify. Settings follow the OWASP Password Storage Cheat Sheet. Store the whole encoded string: it contains the algorithm, parameters, salt and hash.
Verify a password against a hash
Runs entirely in your browser. Your data is never uploaded.
What is Password Hashing Tool?
This tool produces a storage-ready password hash with one click, using the minimum settings from the OWASP Password Storage Cheat Sheet and a fresh random salt. A built-in verifier checks a password against any bcrypt, Argon2, scrypt or PBKDF2 hash string.
How to use Password Hashing Tool
- Type the password into the Password field.
- Choose an Algorithm; Argon2id is recommended.
- Click Hash and copy the Encoded hash.
- To check a password, paste a hash into Verify a password against a hash, type the password and click Verify.
Example
Password hunter2, Argon2id
$argon2id$v=19$m=19456,t=2,p=1$ojaAuqtpNZXLTJQVRP8teg$52egAc/OkuGZUe+ByQP/IxYP4pL6RNdbCi6tx97q308
The salt is random, so you will get a different string each time; every one of them verifies.
When to use Password Hashing Tool
Use it to create test fixtures, seed an admin account, check what a hash format looks like or verify a password against a hash during debugging. In production, hash passwords on the server with a maintained library; never hash on the client instead of the server.
How Password Hashing Tool works
Argon2id (m=19 MiB, t=2, p=1), bcrypt (cost 12) and scrypt (N=2^17, r=8, p=1) are computed with hash-wasm (WebAssembly); PBKDF2-HMAC-SHA-256 with 600,000 iterations uses the browser's Web Crypto API. Each run uses a new 16-byte salt from crypto.getRandomValues. Output formats: bcrypt $2b$, Argon2 PHC string $argon2id$v=19$m=…,t=…,p=…$salt$hash, $scrypt$ln=…,r=…,p=…$salt$hash and passlib $pbkdf2-sha256$iterations$salt$hash. Verification parses the string and recomputes the hash with the stored parameters (constant-time comparison).
Common Use Cases
- Creating a hashed admin password for a database seed
- Verifying that a stored bcrypt hash matches a password
- Generating test fixtures for authentication code
- Comparing hash formats of different algorithms
Security Note
Everything runs in your browser. Avoid pasting production password hashes together with real passwords on shared computers.
FAQs
Which algorithm should I use?
Argon2id for new systems. Use scrypt or bcrypt if your platform lacks Argon2, and PBKDF2 when FIPS-140 compliance is required.
Why is the hash different every time?
A new random salt is used for each hash. The salt is stored inside the encoded string, so verification still works.
Can a hash be reversed?
No. Attackers can only guess passwords and hash each guess, which these slow algorithms make expensive.
Which hash formats can be verified?
bcrypt ($2a$, $2b$, $2y$), Argon2 PHC strings, $scrypt$ strings, passlib $pbkdf2-sha1/sha256/sha512$ and Django pbkdf2_sha256$ hashes.