Hashing · RFC 9106
Argon2
Argon2 is the Password Hashing Competition winner and the current recommended password hash.
Key facts
| Standard | RFC 9106 |
|---|---|
| Variants | Argon2d, Argon2i, Argon2id |
| Recommended | Argon2id |
| Parameters | Memory, iterations, parallelism |
| Winner | Password Hashing Competition, 2015 |
| Salt | Required, stored with the hash |
Three variants
Argon2d uses data-dependent memory access and resists GPU attacks but is more exposed to side channels. Argon2i uses data-independent access for side-channel resistance. Argon2id combines them: the first pass is data-independent, later passes are data-dependent. That hybrid is the recommended default.
The output string encodes the variant, version, parameters, salt and hash, so a verifier can reproduce the computation. Store the whole string rather than the parameters separately.
Choosing parameters
Set memory first, then iterations, then parallelism. A common starting point is 19–64 MB of memory, two or three iterations, and one or two lanes, tuned so one hash takes a fraction of a second on the target server. More memory is generally better than more iterations against parallel hardware.
Argon2 is available in libsodium and many language libraries. If the platform only offers bcrypt, a strong bcrypt cost is still far better than a fast hash.
Frequently asked questions
Which Argon2 variant should I use?
Argon2id for password storage. Argon2d and Argon2i exist for specific threat models.
Do I still need a salt?
Yes. Argon2 requires a salt; use a unique random value per password and store it in the encoded hash.