Bcrypt & Argon2 Hasher & Verifier
Hashes or verifies a password using Bcrypt or Argon2id — the algorithms real backends actually use for password storage, deliberately slow and tunable, unlike a fast general-purpose hash such as SHA-256. Uses hash-wasm, an actively-maintained WebAssembly library, so the output is a real, standard encoded hash (bcrypt's "$2a$10$..." or Argon2's "$argon2id$v=19$m=...,t=...,p=...$salt$hash") that any standard bcrypt or Argon2 library can read directly. Verify mode auto-detects which algorithm produced a pasted hash from its prefix. Runs entirely client-side, in WebAssembly — nothing is uploaded.
About this tool
Hashes or verifies a password using Bcrypt or Argon2id, the two algorithms real backends actually use for password storage — never a plain hash function like SHA-256 or MD5, which are fast by design and therefore weak against brute-force password guessing. Both come from hash-wasm, an actively-maintained, hand-tuned WebAssembly library (not a JavaScript reimplementation), so the output is a real, standard encoded hash — bcrypt's familiar "$2a$10$..." format, or Argon2's "$argon2id$v=19$m=...,t=...,p=...$salt$hash" format — that a real backend using any standard bcrypt or Argon2 library can read directly. Argon2id is the modern OWASP-recommended default for new systems; bcrypt remains extremely common and is the safer choice when you need compatibility with an existing system that already uses it. Verify mode reads the hash's own prefix to detect which algorithm produced it, so checking a password against either kind of hash needs no manual selection.
What you can do
- Bcrypt and Argon2id — hand-tuned WebAssembly, the same algorithms real backends use for password storage
- Verify mode auto-detects which algorithm a pasted hash uses — no need to pick manually
- Adjustable cost (bcrypt) or strength preset (Argon2id) — trade hash time for resistance to brute-force
- Your password never leaves your browser — hashing runs entirely client-side
How to use
Step 1
Pick Hash or Verify
Hash a new password, or check a password against an existing hash.
Step 2
Choose an algorithm and strength
Bcrypt cost factor or Argon2id preset — higher is slower but more resistant to brute-force.
Step 3
Copy the result
The full encoded hash — algorithm, parameters, salt, and digest all in one string.
Example
A bcrypt hash and an Argon2id hash look like this:
Bcrypt
$2a$10$N9qo8uLOickgx2ZMRZoMyeTfmMdmN8eFKxR3xiDBAJqt.vWQw1.JW
Argon2id
$argon2id$v=19$m=19456,t=2,p=1$AQIDBAUGBwgJCgsMDQ4PEA$Ee8NF5VmyKiA9HjvYWwg6taS8pfZqRty8D3E7/xjdrE
Both strings are self-contained — they embed the algorithm, its parameters, and the random salt used, which is exactly what lets Verify mode check a password without you specifying anything except the password itself.
How your data is handled
This tool is labeled 🟢 Runs in your browser: hashing and verification both happen entirely locally using WebAssembly — nothing is uploaded to a server, logged, or retained once you leave the page. Because the password never leaves your browser, this is safe to use with real passwords, not just test values, but treat any password you type into any page with the same care you'd apply anywhere else — only use this on a device and browser you trust.
Frequently asked questions
Why not just use SHA-256 or MD5 to hash a password?+
Those are general-purpose hash functions, designed to be fast — which is exactly the wrong property for password storage, since it makes brute-forcing every possible password cheap. Bcrypt and Argon2 are deliberately slow and tunable (via cost factor or memory/time parameters), which is what makes them resistant to that kind of attack.
Should I use Bcrypt or Argon2id?+
Argon2id is the current OWASP-recommended default for new systems — it's resistant to both GPU-cracking and side-channel attacks in a way bcrypt isn't. Bcrypt remains a reasonable, extremely well-established choice, and is the right pick when you need compatibility with an existing system that already uses it.
What do the Argon2id preset names mean?+
They're simple tiers rather than raw memory/time/parallelism knobs, loosely based on OWASP's Argon2id guidance: "Interactive" for a fast, user-facing login check, up to "Sensitive" for higher-value secrets where a slower hash is worth the tradeoff. Actual hash time depends heavily on your device.
Does this send my password anywhere?+
No — hashing and verification both run entirely in your browser via WebAssembly. Nothing about your password or the resulting hash is uploaded or logged.
Can I use the hash this produces in my own application?+
Yes — both formats are standard, unmodified bcrypt and Argon2id encoded hashes, readable by any mainstream bcrypt or Argon2 library in any language, not a format specific to this tool.