Question 1

What is Argon2?

Accepted Answer

Argon2 is the winner of the 2015 Password Hashing Competition and is the recommended password hashing algorithm by RFC 9106. It comes in three variants: Argon2id (recommended, hybrid), Argon2i (side-channel resistant) and Argon2d (GPU-resistant).

Question 2

What parameters should I use for Argon2?

Accepted Answer

RFC 9106 recommends for production: memory 64 MiB (65536 KiB), iterations 3, parallelism 4, output length 32 bytes. The salt should be 16 random bytes. Higher values are more secure but slower.

Question 3

Is my password sent to a server?

Accepted Answer

No. All Argon2 hashing runs entirely in your browser using the hash-wasm WebAssembly library. Your password never leaves your device.

Question 4

What is the difference between Argon2id, Argon2i and Argon2d?

Accepted Answer

Argon2id is a hybrid of the other two and is the recommended default for most use cases. Argon2i uses data-independent memory access (resistant to side-channel attacks, good for password hashing). Argon2d uses data-dependent memory access (resistant to GPU cracking, good for cryptocurrency).