Argon2 verify
Check a password against an Argon2 hash, on your device.
Runs on your device. The file is never uploaded.
Argon2 verify hands a typed password and a full Argon2 encoded hash to argon2Verify from hash-wasm and prints valid or invalid. The variant, version, memory, iteration and lane figures are read back out of the string, so you set none of them. A bare hex digest carries none of those fields and cannot be checked here at all.
Questions
What does it do?
It checks a password against an Argon2 encoded hash and prints "valid" or "invalid". It calls argon2Verify from hash-wasm in your browser. The hash you paste has to be the full encoded string, the kind starting $argon2id$v=19$, because the salt and cost parameters that verification needs live inside that string.
Do I have to supply the parameters?
No. There are only two options, password and hash. The variant, version, memory, iterations, parallelism and salt are all read out of the encoded string. That is why a hash made with settings different from the defaults on Argon2id hash still verifies here, and why a bare hex digest with no $ segments will not work.
Why does it say invalid when the password looks right?
Two usual causes. The password is not byte-identical, so check for a trailing space, a curly apostrophe pasted from a document, or a different keyboard layout. Or the encoded hash was damaged in copying, since a line break inserted by a mail client or a missing $ segment both change it. The tool passes both values to hash-wasm unchanged and reports only what comes back.
Can it recover the password from the hash?
No. Argon2 runs one way, and this tool tests one candidate at a time. There is no cracking mode, no wordlist and no hint. If the password is unknown, this page cannot help you, and that difficulty is exactly what Argon2 was designed to create.
Is the comparison constant time?
The check is whatever hash-wasm argon2Verify does; this tool adds no comparison of its own and no timing defence. That matters far less here than on a server, because everything runs in your own browser tab against a hash you supplied yourself. There is no remote attacker in a position to time it.
Does anything get uploaded?
No. The password and the hash stay in this tab. hash-wasm runs as WebAssembly in a Web Worker on your device, nothing is sent, and nothing is kept between runs, so you have to paste both values again next time. The page works with the network off, which is a reasonable way to confirm nothing is leaving.