[{"data":1,"prerenderedAt":493},["ShallowReactive",2],{"navigation_docs":3,"-algorithms-argon2id":200,"-algorithms-argon2id-surround":488},[4,40],{"title":5,"path":6,"stem":7,"children":8,"icon":39},"Guide","\u002Fguide","1.guide\u002F01.index",[9,11,15,19,23,27,31,35],{"title":10,"path":6,"stem":7},"Getting Started",{"title":12,"path":13,"stem":14},"Hashing","\u002Fguide\u002Fhashing","1.guide\u002F02.hashing",{"title":16,"path":17,"stem":18},"HMAC and verify","\u002Fguide\u002Fverify","1.guide\u002F03.verify",{"title":20,"path":21,"stem":22},"Salted KDFs","\u002Fguide\u002Fkdf","1.guide\u002F04.kdf",{"title":24,"path":25,"stem":26},"CLI","\u002Fguide\u002Fcli","1.guide\u002F05.cli",{"title":28,"path":29,"stem":30},"Agents","\u002Fguide\u002Fagents","1.guide\u002F06.agents",{"title":32,"path":33,"stem":34},"Custom algorithms","\u002Fguide\u002Fcustom","1.guide\u002F07.custom",{"title":36,"path":37,"stem":38},"Playground","\u002Fguide\u002Fplayground","1.guide\u002F08.playground","i-lucide-book-open",{"title":41,"path":42,"stem":43,"children":44,"icon":199},"Algorithms","\u002Falgorithms","2.algorithms\u002F00.index",[45,47,51,55,59,63,67,71,75,79,83,87,91,95,99,103,107,111,115,119,123,127,131,135,139,143,147,151,155,159,163,167,171,175,179,183,187,191,195],{"title":46,"path":42,"stem":43},"Every algorithm",{"title":48,"path":49,"stem":50},"SHA-256","\u002Falgorithms\u002Fsha256","2.algorithms\u002F01.sha256",{"title":52,"path":53,"stem":54},"SHA-384","\u002Falgorithms\u002Fsha384","2.algorithms\u002F02.sha384",{"title":56,"path":57,"stem":58},"SHA-512","\u002Falgorithms\u002Fsha512","2.algorithms\u002F03.sha512",{"title":60,"path":61,"stem":62},"SHA-224","\u002Falgorithms\u002Fsha224","2.algorithms\u002F04.sha224",{"title":64,"path":65,"stem":66},"SHA-512\u002F224","\u002Falgorithms\u002Fsha512-224","2.algorithms\u002F05.sha512-224",{"title":68,"path":69,"stem":70},"SHA-512\u002F256","\u002Falgorithms\u002Fsha512-256","2.algorithms\u002F06.sha512-256",{"title":72,"path":73,"stem":74},"SHA-512Half","\u002Falgorithms\u002Fsha512-half","2.algorithms\u002F07.sha512-half",{"title":76,"path":77,"stem":78},"SHA3-256","\u002Falgorithms\u002Fsha3-256","2.algorithms\u002F08.sha3-256",{"title":80,"path":81,"stem":82},"SHA3-512","\u002Falgorithms\u002Fsha3-512","2.algorithms\u002F09.sha3-512",{"title":84,"path":85,"stem":86},"Keccak-256","\u002Falgorithms\u002Fkeccak256","2.algorithms\u002F10.keccak256",{"title":88,"path":89,"stem":90},"BLAKE2b","\u002Falgorithms\u002Fblake2b","2.algorithms\u002F11.blake2b",{"title":92,"path":93,"stem":94},"BLAKE2b-256","\u002Falgorithms\u002Fblake2b-256","2.algorithms\u002F12.blake2b-256",{"title":96,"path":97,"stem":98},"BLAKE2b-224","\u002Falgorithms\u002Fblake2b-224","2.algorithms\u002F13.blake2b-224",{"title":100,"path":101,"stem":102},"BLAKE2s","\u002Falgorithms\u002Fblake2s","2.algorithms\u002F14.blake2s",{"title":104,"path":105,"stem":106},"BLAKE3","\u002Falgorithms\u002Fblake3","2.algorithms\u002F15.blake3",{"title":108,"path":109,"stem":110},"BLAKE-256","\u002Falgorithms\u002Fblake256","2.algorithms\u002F16.blake256",{"title":112,"path":113,"stem":114},"RIPEMD-160","\u002Falgorithms\u002Fripemd160","2.algorithms\u002F17.ripemd160",{"title":116,"path":117,"stem":118},"RIPEMD-320","\u002Falgorithms\u002Fripemd320","2.algorithms\u002F18.ripemd320",{"title":120,"path":121,"stem":122},"HASH160","\u002Falgorithms\u002Fhash160","2.algorithms\u002F19.hash160",{"title":124,"path":125,"stem":126},"HASH256","\u002Falgorithms\u002Fhash256","2.algorithms\u002F20.hash256",{"title":128,"path":129,"stem":130},"MD5","\u002Falgorithms\u002Fmd5","2.algorithms\u002F21.md5",{"title":132,"path":133,"stem":134},"MD4","\u002Falgorithms\u002Fmd4","2.algorithms\u002F22.md4",{"title":136,"path":137,"stem":138},"NTLM","\u002Falgorithms\u002Fntlm","2.algorithms\u002F23.ntlm",{"title":140,"path":141,"stem":142},"SHA-1","\u002Falgorithms\u002Fsha1","2.algorithms\u002F24.sha1",{"title":144,"path":145,"stem":146},"SHA-0","\u002Falgorithms\u002Fsha0","2.algorithms\u002F25.sha0",{"title":148,"path":149,"stem":150},"RIPEMD-128","\u002Falgorithms\u002Fripemd128","2.algorithms\u002F26.ripemd128",{"title":152,"path":153,"stem":154},"RIPEMD-256","\u002Falgorithms\u002Fripemd256","2.algorithms\u002F27.ripemd256",{"title":156,"path":157,"stem":158},"CRC-32","\u002Falgorithms\u002Fcrc32","2.algorithms\u002F28.crc32",{"title":160,"path":161,"stem":162},"CRC-16\u002FXMODEM","\u002Falgorithms\u002Fcrc16-xmodem","2.algorithms\u002F29.crc16-xmodem",{"title":164,"path":165,"stem":166},"xxHash (XXH64)","\u002Falgorithms\u002Fxxhash","2.algorithms\u002F30.xxhash",{"title":168,"path":169,"stem":170},"FNV-1a (64-bit)","\u002Falgorithms\u002Ffnv1a","2.algorithms\u002F31.fnv1a",{"title":172,"path":173,"stem":174},"scrypt","\u002Falgorithms\u002Fscrypt","2.algorithms\u002F32.scrypt",{"title":176,"path":177,"stem":178},"PBKDF2","\u002Falgorithms\u002Fpbkdf2","2.algorithms\u002F33.pbkdf2",{"title":180,"path":181,"stem":182},"HKDF","\u002Falgorithms\u002Fhkdf","2.algorithms\u002F34.hkdf",{"title":184,"path":185,"stem":186},"EVP_BytesToKey","\u002Falgorithms\u002Fevp-bytestokey","2.algorithms\u002F35.evp-bytestokey",{"title":188,"path":189,"stem":190},"Argon2id","\u002Falgorithms\u002Fargon2id","2.algorithms\u002F36.argon2id",{"title":192,"path":193,"stem":194},"Argon2i","\u002Falgorithms\u002Fargon2i","2.algorithms\u002F37.argon2i",{"title":196,"path":197,"stem":198},"Argon2d","\u002Falgorithms\u002Fargon2d","2.algorithms\u002F38.argon2d","i-lucide-library",{"id":201,"title":188,"body":202,"description":482,"extension":483,"links":484,"meta":485,"navigation":389,"path":189,"seo":486,"stem":190,"__hash__":487},"docs\u002F2.algorithms\u002F36.argon2id.md",{"type":203,"value":204,"toc":480},"minimark",[205,209,222,306,328,334,337,355,362,468,476],[206,207],"algorithm-facts",{"name":208},"argon2id",[210,211,212,213,217,218,221],"p",{},"Three Argon2 variants, one engine, and a letter that decides how paranoid it gets. RFC 9106 calls argon2id the primary one. It reads memory in a fixed order for the first half of the first pass, like ",[214,215,216],"a",{"href":193},"argon2i",". After that the reads follow the data, like ",[214,219,220],{"href":197},"argon2d",". A side channel learns little. A GPU still pays for every KiB.",[223,224,229],"pre",{"className":225,"code":226,"language":227,"meta":228,"style":228},"language-ts shiki shiki-themes hashes hashes hashes","create(\"argon2id\").hash(\"password\", {\n  salt: \"73616c7473616c74\",\n  memory: 1024,\n  iterations: 2,\n  parallelism: 1,\n}).digest;\n\u002F\u002F \"820ecc0dff8ed2ee188788d8bd38d7269b3a7118c1210bc9e2becc40ebf5039f\"\n","ts","",[230,231,232,263,275,281,287,293,299],"code",{"__ignoreMap":228},[233,234,237,241,245,249,252,255,257,260],"span",{"class":235,"line":236},"line",1,[233,238,240],{"class":239},"sK71F","create",[233,242,244],{"class":243},"s38Sx","(",[233,246,248],{"class":247},"shU9J","\"argon2id\"",[233,250,251],{"class":243},").",[233,253,254],{"class":239},"hash",[233,256,244],{"class":243},[233,258,259],{"class":247},"\"password\"",[233,261,262],{"class":243},", {\n",[233,264,266,269,272],{"class":235,"line":265},2,[233,267,268],{"class":243},"  salt: ",[233,270,271],{"class":247},"\"73616c7473616c74\"",[233,273,274],{"class":243},",\n",[233,276,278],{"class":235,"line":277},3,[233,279,280],{"class":243},"  memory: 1024,\n",[233,282,284],{"class":235,"line":283},4,[233,285,286],{"class":243},"  iterations: 2,\n",[233,288,290],{"class":235,"line":289},5,[233,291,292],{"class":243},"  parallelism: 1,\n",[233,294,296],{"class":235,"line":295},6,[233,297,298],{"class":243},"}).digest;\n",[233,300,302],{"class":235,"line":301},7,[233,303,305],{"class":304},"scIB-","\u002F\u002F \"820ecc0dff8ed2ee188788d8bd38d7269b3a7118c1210bc9e2becc40ebf5039f\"\n",[210,307,308,309,312,313,316,317,320,321,324,325,327],{},"That salt is ",[230,310,311],{},"saltsalt"," in hex. Why not plain ",[230,314,315],{},"salt","? Argon2 wants at least 8 bytes, so four get an ",[230,318,319],{},"InvalidOptionError",". Leave the salt out and 32 random bytes come back in ",[230,322,323],{},"result.options",". ",[214,326,20],{"href":21}," says why you keep them.",[210,329,330,333],{},[230,331,332],{},"memory"," counts KiB, not bytes. The defaults are RFC 9106's second recommended option: 64 MiB, 3 passes, 4 lanes, 32 bytes out. Its first option wants 2 GiB. Fine on a server, rude in a browser tab. So the page above runs its sample at 1 MiB.",[210,335,336],{},"Lanes change the result, not the speed. This is plain TypeScript on one thread, and the lanes run one after another. Matching a hash from somewhere else? Copy all four numbers, or you get a perfectly valid wrong digest.",[210,338,339,342,343,346,347,324,349,351,352,354],{},[230,340,341],{},"secret"," and ",[230,344,345],{},"associatedData"," take hex. They're K and X in the RFC, mixed into the first hash. A pepper goes in ",[230,348,341],{},[230,350,345],{}," comes back in ",[230,353,323],{},", the secret doesn't. You already have it, and a log doesn't need it.",[210,356,357,358,361],{},"Need the bytes for another library? ",[230,359,360],{},"@agntn\u002Fhashes\u002Fargon2"," has all three variants as plain functions:",[223,363,365],{"className":225,"code":364,"language":227,"meta":228,"style":228},"import { argon2id } from \"@agntn\u002Fhashes\u002Fargon2\";\n\nconst text = new TextEncoder();\nargon2id(text.encode(\"password\"), text.encode(\"saltsalt\"), {\n  memory: 1024,\n  iterations: 2,\n  parallelism: 1,\n  keyLength: 32,\n});\n\u002F\u002F the same 32 bytes as above\n",[230,366,367,385,391,411,438,442,446,450,456,462],{"__ignoreMap":228},[233,368,369,373,376,379,382],{"class":235,"line":236},[233,370,372],{"class":371},"skH_V","import",[233,374,375],{"class":243}," { argon2id } ",[233,377,378],{"class":371},"from",[233,380,381],{"class":247}," \"@agntn\u002Fhashes\u002Fargon2\"",[233,383,384],{"class":243},";\n",[233,386,387],{"class":235,"line":265},[233,388,390],{"emptyLinePlaceholder":389},true,"\n",[233,392,393,396,399,402,405,408],{"class":235,"line":277},[233,394,395],{"class":371},"const",[233,397,398],{"class":243}," text ",[233,400,401],{"class":371},"=",[233,403,404],{"class":371}," new",[233,406,407],{"class":239}," TextEncoder",[233,409,410],{"class":243},"();\n",[233,412,413,415,418,421,423,425,428,430,432,435],{"class":235,"line":283},[233,414,208],{"class":239},[233,416,417],{"class":243},"(text.",[233,419,420],{"class":239},"encode",[233,422,244],{"class":243},[233,424,259],{"class":247},[233,426,427],{"class":243},"), text.",[233,429,420],{"class":239},[233,431,244],{"class":243},[233,433,434],{"class":247},"\"saltsalt\"",[233,436,437],{"class":243},"), {\n",[233,439,440],{"class":235,"line":289},[233,441,280],{"class":243},[233,443,444],{"class":235,"line":295},[233,445,286],{"class":243},[233,447,448],{"class":235,"line":301},[233,449,292],{"class":243},[233,451,453],{"class":235,"line":452},8,[233,454,455],{"class":243},"  keyLength: 32,\n",[233,457,459],{"class":235,"line":458},9,[233,460,461],{"class":243},"});\n",[233,463,465],{"class":235,"line":464},10,[233,466,467],{"class":304},"\u002F\u002F the same 32 bytes as above\n",[210,469,470,471,342,473,475],{},"No defaults and no random salt here. You pass the four numbers, and ",[230,472,341],{},[230,474,345],{}," as bytes if you need them. Anything RFC 9106 rules out throws before a single block is allocated. Asking for 2 GiB? It'll try. Only the tools cap memory.",[477,478,479],"style",{},"html pre.shiki code .sK71F, html code.shiki .sK71F{--shiki-light:var(--shiki-token-function);--shiki-default:var(--shiki-token-function);--shiki-dark:var(--shiki-token-function)}html pre.shiki code .s38Sx, html code.shiki .s38Sx{--shiki-light:var(--ui-text-highlighted);--shiki-default:var(--ui-text-highlighted);--shiki-dark:var(--ui-text-highlighted)}html pre.shiki code .shU9J, html code.shiki .shU9J{--shiki-light:var(--shiki-token-string);--shiki-default:var(--shiki-token-string);--shiki-dark:var(--shiki-token-string)}html pre.shiki code .scIB-, html code.shiki .scIB-{--shiki-light:var(--shiki-token-comment);--shiki-default:var(--shiki-token-comment);--shiki-dark:var(--shiki-token-comment)}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .skH_V, html code.shiki .skH_V{--shiki-light:var(--shiki-token-keyword);--shiki-default:var(--shiki-token-keyword);--shiki-dark:var(--shiki-token-keyword)}",{"title":228,"searchDepth":265,"depth":265,"links":481},[],"The Argon2 that RFC 9106 tells you to pick. Memory-hard with a salt it draws and prints when you give none","md",null,{},{"title":188,"description":482},"UA-_pYqm3JkrIzm694dNNr_YwQa98ADOK0BssukcQEw",[489,491],{"title":184,"path":185,"stem":186,"description":490,"children":-1},"The key and IV behind openssl enc without -pbkdf2 and behind CryptoJS with a passphrase. Old and weak and still everywhere",{"title":192,"path":193,"stem":194,"description":492,"children":-1},"Argon2 with memory reads that never depend on the password. Side channels get nothing and it needs more passes for it",1790887232567]