Argon2 Verify

Use the steps below to check a candidate Argon2 password.

Check a candidate Argon2 password

1. Type the test password into Password / String to verify.
2. Keep Target Hash enabled and paste the complete encoded hash into Hash to Verify Against. Leave Key Encoding (Search/Type): at UTF-8.
3. Set Input Encoding: to the representation of the candidate password, using UTF-8 for normal text.
4. Keep Auto / Live on to update the result as you edit. To work manually, turn Auto / Live off and click Run.
5. Read Verification Result. VALID (Match) indicates a match; INVALID (Mismatch) can also indicate an unsupported or malformed hash.
6. Click Copy to copy the result. Use Clear where shown, or a field's clear control, to clear the text.

For example, the password million-test and hash $argon2id$v=19$m=65536,t=4,p=1$WOTd/tGxakQ5SF4t61ZueA$/5pJ3KHg0yZxoK9yPKNLkUDCOlLu4Q1cyR2VDypU+Ls produce VALID (Match). Replacing the password with wrong produces INVALID (Mismatch).

Check the accepted hash format

The verifier reads version-19 argon2id, argon2i, and argon2d strings. Its current bounds are memory at most 65536 KiB, iterations at most four, and parallelism at most four. Salt and digest fields must also fit the accepted format and length checks.

Interpret a mismatch carefully

A result of INVALID (Mismatch) can mean a wrong password, unsupported parameters, a malformed hash, or a verification error. Keep the full original encoded hash and match the password byte representation used when it was created.