What Is Argon2? The Modern Password Hash

Argon2 is a modern, memory-hard password hashing algorithm that won the Password Hashing Competition and is now the leading recommendation for storing passwords securely. It is deliberately slow and consumes a configurable amount of memory, which makes large-scale cracking with GPUs or specialized hardware dramatically more expensive than with older, memory-light functions. Argon2 automatically salts each password and lets you tune memory, time, and parallelism to match your hardware.

Key takeaways

• Argon2 is the Password Hashing Competition winner and the current first-choice password hashing algorithm.
• It is memory-hard, using large tunable memory to resist GPU and ASIC cracking rigs.
• Argon2 has three variants; Argon2id is the recommended general-purpose choice.
• Its main parameters are memory cost, time (iterations), and parallelism.
• It salts automatically and produces a self-describing encoded string you store directly.
• Parameters should be as high as your login latency budget allows and can be upgraded over time.

What is Argon2 and why was it created?

Argon2 emerged as the winner of the Password Hashing Competition, an open effort to identify a next-generation password hashing standard. The motivation was that older functions, while still secure, were not designed to resist attackers wielding cheap, massively parallel hardware. bcrypt is slow but uses little memory, and PBKDF2 uses little memory too, so both can be attacked efficiently on GPUs.

Argon2 was designed from the start to be memory-hard. Computing a hash requires filling and repeatedly accessing a large block of memory, and memory bandwidth and capacity are expensive to scale in parallel. This shifts the economics against attackers, making Argon2 well suited to defending passwords on modern hardware.

What are the Argon2 variants?

Argon2 comes in three flavors, each with a different tradeoff:

• Argon2d uses data-dependent memory access, which maximizes resistance to GPU cracking but can be vulnerable to certain side-channel attacks. It suits settings without side-channel risk, like cryptocurrencies.
• Argon2i uses data-independent memory access, which resists side-channel timing attacks and is intended for password hashing where such attacks are a concern.
• Argon2id is a hybrid that runs a data-independent pass followed by data-dependent access, combining the strengths of both.

For password storage, Argon2id is the recommended default because it balances resistance to both side-channel and GPU-based attacks.

What parameters does Argon2 take?

Argon2’s cost is governed by three primary parameters:

• Memory cost sets how much RAM each hash computation uses. Higher memory is the core of Argon2’s defense.
• Time cost, or iterations, sets how many passes are made over the memory, increasing computation time.
• Parallelism sets how many parallel lanes the computation uses, which you can align with available CPU cores.

You also supply a salt, which the algorithm mixes in, and you specify the desired output length. Tuning these lets you trade off security against the time and memory your servers can spare per login. Increasing memory cost raises the bar for parallel attackers most sharply, since attackers must provision that memory for every simultaneous guess.

How do you choose Argon2 parameters?

There is no single universal setting because it depends on your hardware and your acceptable login latency. The practical method is:

1. Decide the maximum time you can spend hashing a password at login without hurting user experience.
2. Set parallelism to match the cores you are willing to dedicate.
3. Raise the memory cost as high as your servers can afford while staying within your time budget.
4. Use the time cost to fine-tune the total duration.
5. Benchmark on your real production hardware, since results vary widely between machines.

Follow current published guidance for baseline values, then test and adjust. The principle is simple: make each hash as expensive as you can tolerate, because every bit of cost applies equally to every attacker guess.

What does an Argon2 encoded hash look like?

Like bcrypt, Argon2 libraries return a single self-describing string containing the variant, version, parameters, salt, and hash, using a standardized encoding. It looks similar to this:

$argon2id$v=19$m=65536,t=3,p=4$c29tZXNhbHQ$RdescudvJCsgt3ub+b+dWRWJTmaaJObG

Reading the fields:

• argon2id is the variant.
• v=19 is the algorithm version.
• m, t, and p are the memory, time, and parallelism parameters.
• The last two segments are the base64-encoded salt and hash.

Because all parameters travel with the hash, verification and future parameter upgrades are straightforward.

How does Argon2 compare to bcrypt and scrypt?

Argon2’s independent control over memory, time, and parallelism gives it the most flexible cost model of the three, which is a major reason it is favored for new deployments.

What are common Argon2 pitfalls?

• Setting memory too low. Under-provisioning memory undercuts the entire point of a memory-hard function.
• Copying parameters blindly. Values that suit one server may be too weak or too slow on another; always benchmark.
• Choosing the wrong variant. Use Argon2id for passwords unless you have a specific reason not to.
• Denial-of-service through cost. Because each hash uses significant memory and CPU, a flood of login attempts can exhaust resources; combine Argon2 with rate limiting.
• Implementing it yourself. Use a vetted library; hand-rolled cryptographic code is dangerous.
• Never revisiting parameters. As hardware improves, periodically raise your settings and re-hash on login.

Should you use Argon2 or bcrypt?

For a new application, Argon2id is the recommended default. Its memory-hardness provides the strongest resistance to modern parallel cracking hardware, and its flexible parameters let you tune it precisely. Choose bcrypt when you need the broadest possible library support, are working within an ecosystem where it is the established standard, or must remain compatible with existing hashes. Both are legitimate, secure choices, and either is vastly better than a fast general-purpose hash. The essential rule stands: always store passwords with a slow, salted, purpose-built function, and pair it with rate limiting and sound authentication design.

Frequently asked questions

Which Argon2 variant should I use?

Argon2id is the recommended default for password hashing. It combines the side-channel resistance of Argon2i with the GPU-cracking resistance of Argon2d.

Why is Argon2 called memory-hard?

It deliberately uses a large, configurable amount of memory to compute each hash, which makes massively parallel GPU and ASIC attacks far more expensive.

Does Argon2 need a separate salt?

No. Argon2 uses a salt and its encoded output embeds the salt and parameters, so you store just the single resulting string.

What parameters does Argon2 take?

Chiefly memory size, an iteration or time cost, and a degree of parallelism. Together they determine how expensive each hash computation is.

Is Argon2 better than bcrypt?

Argon2 is memory-hard and is the modern first recommendation, while bcrypt is not memory-hard. Both are secure when properly configured.

How do I choose Argon2 parameters?

Pick the highest memory and iteration values your servers tolerate within an acceptable login time, following current guidance and testing on your own hardware.

Can I upgrade Argon2 parameters later?

Yes. On successful login, if a stored hash used weaker parameters, re-hash the verified password with stronger ones and store the new value.