Password Hash Generator
Generate secure password hashes for safe credential storage with our free online tool. Learn proper password hashing techniques using algorithms designed specifically for protecting user credentials.
Why Hash Passwords?
Plain text passwords are a catastrophic security vulnerability. When databases are breached (which happens regularly), hashed passwords protect users even if attackers obtain the entire database. Proper password hashing makes cracking infeasible.
Password Hashing Algorithms Comparison
| Algorithm | Introduced | Type | Security | Speed | Recommendation |
|---|---|---|---|---|---|
| Argon2id | 2015 | Memory-hard | Excellent | Configurable | Best choice |
| bcrypt | 1999 | CPU-hard | Strong | Slow | Good alternative |
| scrypt | 2009 | Memory-hard | Strong | Configurable | Good for GPU resistance |
| PBKDF2 | 2000 | Iteration-based | Moderate | Configurable | NIST approved |
| SHA-256 | 2001 | Fast hash | Weak for passwords | Very fast | Never use alone |
| MD5 | 1992 | Fast hash | Broken | Extremely fast | Never use |
Password Storage Requirements
| Feature | Purpose | Implementation |
|---|---|---|
| Salting | Prevents rainbow tables | Unique random salt per password |
| Work Factor | Slows brute force | Adjust iterations/memory |
| Constant Time | Prevents timing attacks | Use secure comparison |
| Pepper | Defense in depth | Application-level secret |
JavaScript Password Hashing
``javascript
// Using bcrypt (Node.js) - Recommended
const bcrypt = require('bcrypt');
async function hashPassword(password) {
const saltRounds = 12; // Adjust based on server capabilities
const hash = await bcrypt.hash(password, saltRounds);
return hash;
}
async function verifyPassword(password, hash) {
return await bcrypt.compare(password, hash);
}
// Using Argon2 (best security)
const argon2 = require('argon2');
async function hashWithArgon2(password) {
const hash = await argon2.hash(password, {
type: argon2.argon2id,
memoryCost: 65536, // 64 MB
timeCost: 3, // 3 iterations
parallelism: 4 // 4 threads
});
return hash;
}
async function verifyArgon2(password, hash) {
return await argon2.verify(hash, password);
}
// Browser-based (Web Crypto with PBKDF2)
async function deriveKeyFromPassword(password, salt) {
const encoder = new TextEncoder();
const keyMaterial = await crypto.subtle.importKey(
'raw',
encoder.encode(password),
'PBKDF2',
false,
['deriveBits']
);
const derivedBits = await crypto.subtle.deriveBits(
{
name: 'PBKDF2',
salt: salt,
iterations: 310000, // OWASP 2023 recommendation
hash: 'SHA-256'
},
keyMaterial,
256
);
return Array.from(new Uint8Array(derivedBits))
.map(b => b.toString(16).padStart(2, '0'))
.join('');
}
``
Work Factor Guidelines (2024)
| Algorithm | Minimum | Recommended | High Security |
|---|---|---|---|
| bcrypt | 10 rounds | 12 rounds | 14+ rounds |
| Argon2id | 64 MB / 3 iter | 64 MB / 4 iter | 256 MB / 4 iter |
| scrypt | N=2^14 | N=2^15 | N=2^17 |
| PBKDF2-SHA256 | 210,000 iter | 310,000 iter | 600,000 iter |
Common Password Hashing Mistakes
| Mistake | Why It's Dangerous | Correct Approach |
|---|---|---|
| Using MD5/SHA | Too fast to crack | Use bcrypt/Argon2 |
| No salt | Rainbow table attacks | Always use unique salt |
| Shared salt | Easier batch cracking | Generate random salt per user |
| Low work factor | Faster brute force | Benchmark and maximize |
| Double hashing | No security benefit | Use proper algorithm |
Password Hashing Best Practices
Choose Argon2id as your first choice (winner of Password Hashing Competition). Use bcrypt if Argon2 is unavailable. Set work factors to take 250-500ms on your production hardware. Increase work factors every 2-3 years. Never implement your own password hashing—use established libraries.