Password Hash Generator and Verifier
Generate, verify and measure one local bcrypt, Argon2id, PBKDF2-SHA256 or educational salted-SHA256 operation.
1. Local input and settings
Inputs stay in memory: no uploads, URLs, storage or requests. Each field32KiB; full output1MiB. Worker:10s startup/1s processing. Editing cancels work and clears old exports. Use synthetic examples for learning.
Model, bounds and sources
UTF8 passwords are not normalized; max1,024 bytes, bcrypt72 bytes without truncation. crypto RNG salt16–32 bytes (bcrypt16), entered as hex. bcrypt cost4–14; Argon2id v19 memory16–64MiB/time1–4/lanes1–4/hash32 bytes; PBKDF2-SHA25610,000–2,000,000 iterations/hash32 bytes. Lower costs are educational, not deployment recommendations. Verification strictly validates the selected algorithm and encoded policy before crypto. bcrypt/Argon PHC are standard; PBKDF2/SHA use explicit g3n-v1 envelopes. SHA256(salt bytes || UTF8 password) is unsuitable for password storage. Benchmark is one selected operation, not server or algorithm comparison. Worker10s startup/1s processing; high-cost work may time out. Native WebCrypto offers no hard-abort guarantee; Worker termination clears UI and blocks late results. No automatic memory zeroization guarantee.
Source controls and references inspected2026-10-19.
2. Complete result
Review settings, then process locally.
How to use this tool
Enter local input, choose the explicit rules or algorithm, then run and export the complete result.
When not to use it
UTF8 passwords are not normalized; max1,024 bytes, bcrypt72 bytes without truncation. crypto RNG salt16–32 bytes (bcrypt16), entered as hex. bcrypt cost4–14; Argon2id v19 memory16–64MiB/time1–4/lanes1–4/hash32 bytes; PBKDF2-SHA25610,000–2,000,000 iterations/hash32 bytes. Lower costs are educational, not deployment recommendations. Verification strictly validates the selected algorithm and encoded policy before crypto. bcrypt/Argon PHC are standard; PBKDF2/SHA use explicit g3n-v1 envelopes. SHA256(salt bytes || UTF8 password) is unsuitable for password storage. Benchmark is one selected operation, not server or algorithm comparison. Worker10s startup/1s processing; high-cost work may time out. Native WebCrypto offers no hard-abort guarantee; Worker termination clears UI and blocks late results. No automatic memory zeroization guarantee.