Search code examples
hashpasswords

How do I store Argon2 passwords in my database?

I'm trying to store user passwords in my DB using Argon2 algorithm.

This is what I obtain by using it:

$echo -n "password" | argon2 "smallsalt" -id -t 4 -m 18 -p 4
Type:           Argon2id
Iterations:     4
Memory:         262144 KiB
Parallelism:    4
Hash:           cb4447d91dd62b085a555e13ebcc6f04f4c666388606b2c401ddf803055f54ac
Encoded:        $argon2id$v=19$m=262144,t=4,p=4$c21hbGxzYWx0$y0RH2R3WKwhaVV4T68xvBPTGZjiGBrLEAd34AwVfVKw
1.486 seconds
Verification ok

In this case, what should I store in the DB?

  • The "encoded" value as shown above?
  • The "hash" value as shown above?
  • Neither, but another solution?

Please, could you help me? I'm a newbie with this and I'm a little bit lost.

Solution

  • I'm a bit late to the party, but I disagree with the previous answers.
    You should store the field: Encoded
    The $argon2id$.... value.

    (At least if you are using normal Argon2 libraries having the verify() function. It does not look like the man-page for argon2 command does this, however.

    Only if you are stuck with the command line, you should consider storing each field individually.)

    The $argon2id$ encoded hash
    The argon2 encoded hash follows the same as its older cousin bcrypt's syntax.

    The encoded hash includes all you ever need to verify the hash when the user logs in.

    It is most likely more future proof. When a newer and better argon2 comes along: You can upgrade your one column hashed passwords. Just like you could detect bcrypt's $2a$-hashes, and re-hash them as $argon2id$-hashes, next time the user logs in. (If you were moving from bcrypt to agron2.)

    TL;DR
    Store the $-encoded value encoded_hash in your database.
    Use argon2.verify(password, encoded_hash) to verify that the password is correct.

    Don't bother about all the values inside the hash. Let the library do that for you. :)