OneTaskBy Tim King · Updated
Password Hash Generator
Argon2id, scrypt and PBKDF2 Hashes at OWASP Default Settings, With the Encoded String
OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.
How the Password Hash Generator works
This password hash generator hashes a password with Argon2id, scrypt or PBKDF2 and gives you the encoded string that libraries store and verify, along with the raw hash, the salt and the time it took. Defaults follow the OWASP Password Storage Cheat Sheet, and everything runs in your browser.
How the password hash generator sets its parameters
Leave the cost box blank to use the OWASP minimums: Argon2id with 19 MiB of memory, 2 passes and 1 lane;
scrypt with N=2^17, r=8, p=1; PBKDF2-SHA256 with 600,000 iterations; and PBKDF2-SHA512 with 210,000. To
change them, type the numbers separated by commas in the same order, for example 65536, 3, 4 for
Argon2. The scrypt N must be a power of two.
Encoded formats
Argon2 output uses the PHC string format, such as $argon2id$v=19$m=19456,t=2,p=1$salt$hash, which
libraries in every major language accept. The scrypt string uses the same style with ln as the log2 of
N. PBKDF2 uses the passlib format. Argon2 and scrypt run on hash-wasm, a WebAssembly library, and PBKDF2
uses the browser's Web Crypto API.
FAQ
Which algorithm should I use?
Argon2id, unless your platform does not support it. It is the winner of the Password Hashing Competition and resists both GPU cracking and side-channel attacks. scrypt is a good second choice, and PBKDF2 is there for FIPS environments that require it. Avoid plain SHA-256 or MD5 for passwords.
Why does the hash change every time?
A new random salt is used unless you enter one. Salting means two users with the same password get different hashes, which defeats precomputed tables. To reproduce a specific hash, paste its salt in hex and use the same parameters.
Should I hash production passwords here?
Use this to learn the formats, test your verification code or pick parameters. Your application should hash passwords itself at sign-up and log-in, so the plaintext never travels anywhere else. Nothing is sent from this page, but good practice keeps real credentials out of any web tool.
See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.
Related tools
Bcrypt Generator
Generate and verify bcrypt password hashes.
Password Hash Identifier
Identify bcrypt, Argon2, sha512crypt, NTLM, MD5 and other hash formats.
Hash Generator
Generate MD5, SHA-1, SHA-256 and SHA-512 digests from text.
HMAC-SHA256 Generator
Sign a message with HMAC-SHA256 and verify signatures.
Bcrypt Cost Benchmark
Time bcrypt cost factors and pick one that fits your login budget.