Home / Knowledge hub / Argon2
Knowledge hub
Argon2
A modern password hashing function that is slow and memory-hungry on purpose.
What it means
Argon2 is a password hashing function that won the Password Hashing Competition in 2015 and is specified in RFC 9106. It is designed to be slow and to use a lot of memory, which makes cracking expensive. An attacker needs the memory as well as the computing power for every guess.
It comes in three variants. Argon2d resists graphics hardware best, Argon2i resists side-channel leaks, and Argon2id combines both. For passwords, Argon2id is the one to use. You control three settings: memory size, number of passes, and the degree of parallelism.
Why it matters
Cracking rigs rely on thousands of cheap cores. Memory-hungry functions undercut that advantage, because every guess must reserve real memory. The result is that a stolen set of Argon2id hashes costs far more to crack than the same set hashed with a fast algorithm or with an older design.
It is the current first choice in OWASP’s password storage guidance. If you build a new product, picking it now avoids a migration later. If you already use bcrypt with a sound cost factor, you are not in trouble, and a planned move at the next sign-in is enough.
How it shows up
In code, you call a library and pass settings. OWASP’s minimum is Argon2id with 19 MiB of memory, two iterations and one degree of parallelism, with equivalent combinations that trade memory against time. The output is a string that records the variant, settings and salt, so it verifies by itself.
Mistakes: using Argon2d or Argon2i for passwords when Argon2id exists, setting memory so low that the advantage is lost, setting it so high that a burst of logins takes down the server, and never re-tuning. Test sign-in time under load, and treat the settings like any other security configuration.
Questions people ask
Argon2, answered
Is Argon2 better than bcrypt?
For new systems, usually yes, because it is memory-hard and tunable. bcrypt remains acceptable and widely supported. The best choice is the one your platform supports well and that you configure properly.
Settings matter more than the label.
Which Argon2 variant should I use?
Argon2id. It blends the data-dependent and data-independent approaches, and RFC 9106 recommends it as the primary option for most uses, including password hashing.
Use the defaults your library recommends for it.
What do the Argon2 settings mean?
Memory is how much RAM each hash needs, iterations are the number of passes over it, and parallelism is how many threads work on it. Raising memory or iterations raises cost for everybody trying to guess.
Tune them on your servers.
Does Argon2 need a salt?
Yes, a unique random salt per password, and good libraries generate it automatically and store it in the output string. Never reuse one salt for all users.
A pepper is a separate, optional extra.
Can Argon2 protect weak passwords?
It slows guessing, which helps, but a very common password will still fall quickly. Pair it with rules that reject known-breached or obvious passwords and with MFA.
Slow hashing buys time, not safety.
Related
Terms that sit next to this one
bcrypt
A deliberately slow password hashing function with a built-in salt.
scrypt
A password hashing function that needs a lot of memory, which slows cracking hardware.
PBKDF2
An older password hashing method that repeats a hash many thousands of times.
Key derivation function (KDF)
A function that turns a password or secret into a strong, fixed-size key.
Pepper
A secret added to every password hash and kept outside the database.
Which hash does your login use?
Password storage is easy to read in code. In white-box mode Cyberlop reads your code while testing the running app, so a finding can point to the file and line. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.