Cybersecurity glossary
What is Argon2?
Learn what Argon2 is, how memory-hard password hashing resists GPU attacks, which Argon2id parameters to choose, and how it compares to bcrypt and scrypt.
Definition
Argon2 is a memory-hard password-hashing and key-derivation function that won the Password Hashing Competition; its Argon2id variant is widely recommended for storing passwords because it resists both side-channel leakage patterns and massively parallel GPU/ASIC cracking.
Why Argon2 became the modern password default
When password databases leak, attackers do not “decrypt” hashes—they guess. Fast hashes let GPUs test billions of candidates. Argon2 was designed so each guess consumes meaningful memory and time, raising the bill for offline cracking without making legitimate logins unbearable.
It won the Password Hashing Competition and is now the usual recommendation for new password storage alongside careful UX and MFA.
What makes Argon2 different
Argon2 is memory-hard: the algorithm fills and mixes a large memory array. Parallel crackers that thrash through weak passwords must provision RAM per attempt, which limits how densely they can pack guesses onto GPUs or ASICs.
Argon2d
Data-dependent memory access; strong against GPU cracking but more exposed to certain side-channel observations.
Argon2i
Data-independent access patterns; better side-channel posture, historically preferred in some constrained settings.
Argon2id
Hybrid recommended for password hashing: early side-channel resistance with later GPU resistance.
Tunable cost
Memory, iterations, and lanes let you scale difficulty as hardware improves.
How password verification with Argon2 works
User submits a password
The credential arrives over TLS to the authentication service.
Load stored parameters
The verifier reads salt, memory, time, parallelism, and the Argon2 output from the password record.
Compute Argon2id
The server derives a hash using the same parameters and salt as enrollment.
Constant-time compare
The result is compared to the stored hash without early-exit leaks.
Enforce rate limits
Online guessing is slowed by lockouts, MFA, and anomaly detection even when hashing is strong.
Rehash on login when needed
If policy raises memory or time costs, upgrade the stored hash after a successful login.
Argon2 compared with other password KDFs
| Algorithm | Primary hardness | Modern guidance |
|---|---|---|
| Argon2id | Memory + time + parallelism | Preferred for new password storage |
| scrypt | Memory-hard | Acceptable; tune memory carefully |
| bcrypt | CPU/time adaptive | Fine if already deployed with strong cost |
| PBKDF2 | Iteration count | Legacy; raise iterations or migrate |
Deployment checklist
- Use Argon2id for password verifiers in new applications.
- Generate a unique salt per password and store it with the hash.
- Benchmark parameters on production-like hardware so login latency stays within UX budgets.
- Increase memory first when raising cost, then time, following current OWASP baselines for your version.
- Store the full encoded hash (algorithm, version, params, salt, digest) rather than inventing a custom format.
- Combine with MFA, breach detection, and credential stuffing defenses—hashing alone does not stop online attacks.
- Plan a transparent rehash-on-login path when parameters need upgrading.
- Never log plaintext passwords or Argon2 inputs during debugging.
Tuning without shooting yourself in the foot
Undersized memory makes Argon2 behave like a fancy slow hash that GPUs can still abuse. Oversized memory can DoS your own auth nodes under login spikes. Measure p95 latency, provision horizontal capacity, and treat parameter changes as a security release—not a silent config tweak.
Peppering (an application secret mixed into hashing) can help when salts alone are insufficient against full database theft, but only if the pepper lives outside the database and has a rotation story.
The practical takeaway
Argon2—especially Argon2id—is the modern choice for password hashing because it forces attackers to spend memory, not just cycles. Tune it to your hardware, keep salts unique, and pair it with strong online defenses and MFA.
Related security terms
bcrypt
A widely deployed adaptive password hash that predates Argon2.
scrypt
Another memory-hard KDF often compared when selecting password hashing.
PBKDF2
An older iteration-based KDF still common but less memory-hard than Argon2.
Key Derivation Function (KDF)
The broader family of functions that turn secrets into keys or password verifiers.
Salt (Cryptography)
Per-password randomness that prevents identical hashes across users.
Frequently asked questions
What is Argon2 in simple terms?
Argon2 turns a password into a hash that is intentionally expensive to compute and memory-hungry to parallelize, so stolen password databases are harder to crack at scale.
Which Argon2 variant should I use?
Prefer Argon2id for password storage. It blends data-independent and data-dependent approaches to balance side-channel resistance and GPU attack resistance.
What parameters matter for Argon2?
Memory size, time (iterations), and parallelism. Tune them so legitimate logins stay fast enough while offline cracking becomes costly on your threat model’s hardware.
Is Argon2 better than bcrypt?
For new systems, Argon2id is generally preferred because memory hardness raises the cost of GPU/ASIC cracking more effectively. bcrypt remains acceptable when already deployed and correctly parameterized.
Can Argon2 derive encryption keys as well as password hashes?
Yes. Argon2 can act as a KDF to produce keys from passphrases, though dedicated protocols may still wrap the result with additional key-handling steps.
Do I still need a salt with Argon2?
Yes. Use a unique, high-entropy salt per password. Argon2 libraries usually generate and encode the salt into the stored hash string.
Should I hash passwords on the client with Argon2?
Server-side hashing remains the baseline. Client-side hashing can help niche threat models but does not replace TLS, server verifiers, or rate limiting.
References
Explore authoritative guidance and frameworks related to argon2.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.