Security & Quality

Argon2 Password Hashing

Use Argon2, the Password Hashing Competition winner, for state-of-the-art password security in Node.js.

Claude Code Cursor Copilot Windsurf Gemini CLI

Overview

Argon2 is the winner of the 2015 Password Hashing Competition and is recommended by OWASP as the preferred password hashing algorithm. The node-argon2 library provides Node.js bindings for the reference C implementation, offering three variants: Argon2d (GPU-resistant), Argon2i (side-channel resistant), and Argon2id (hybrid, recommended).

Unlike bcrypt, Argon2 allows fine-tuning of memory usage, parallelism, and time cost independently. This memory-hard design makes it significantly more resistant to GPU and ASIC-based cracking attacks. The default Argon2id variant combines the strengths of both Argon2d and Argon2i, providing resistance against both side-channel and GPU attacks.

The node-argon2 library provides a simple async API with sensible defaults following OWASP recommendations. It automatically generates cryptographically secure salts, encodes parameters in the PHC string format, and supports verification of hashes created with different parameters. This makes it straightforward to upgrade security parameters over time without invalidating existing password hashes.

Who Is This For?

Hash passwords with memory-hard Argon2id algorithm
Upgrade from bcrypt to Argon2 for stronger security
Configure memory and time cost for specific hardware
Verify passwords with automatic parameter detection

Installation

Setup for Claude Code

npm install argon2

Configuration

import argon2 from "argon2"

// Hash with Argon2id (default, recommended)
const hash = await argon2.hash(password, {
  type: argon2.argon2id,
  memoryCost: 65536, // 64 MB
  timeCost: 3,
  parallelism: 4,
})

// Verify
const isValid = await argon2.verify(hash, password)