Password hash generator and checker
Create a password hash the way a server should store it — bcrypt, Argon2id, scrypt or PBKDF2 — or check whether a password matches a hash you already have.
Nothing is sent, but it is good practice never to type a password you really use into any website.
Create a hash
Check a password
完全在你的浏览器中运行 — 不会发送到任何地方
Reading an encoded hash
$argon2id$v=19$m=19456,t=2,p=1$<salt>$<hash> names the algorithm, its version and parameters, then the salt and the result. Everything needed to check a password is in the string, which is why it is stored as one field.
Which should I use?
Argon2id for new systems, as OWASP recommends; bcrypt where Argon2 is unavailable; scrypt and PBKDF2 where a standard requires them. The defaults here are OWASP’s recommended minimums.
Why not SHA-256?
Plain hashes are built to be fast, so an attacker can test billions of guesses a second. Password hashes are deliberately slow and use a random salt, so each guess is expensive and identical passwords hash differently.
Why do the formats differ between libraries?
bcrypt and Argon2 have standard encoded forms; scrypt and PBKDF2 do not, and libraries vary. The hash and salt here are standard Base64 without padding.