{"id":16216261,"url":"https://github.com/matthewhartstonge/argon2","last_synced_at":"2026-05-25T02:06:02.913Z","repository":{"id":43704148,"uuid":"135153072","full_name":"matthewhartstonge/argon2","owner":"matthewhartstonge","description":"A pure Go Argon2 implementation for secure password hashing in Go!","archived":false,"fork":false,"pushed_at":"2024-10-08T20:08:06.000Z","size":142,"stargazers_count":91,"open_issues_count":0,"forks_count":4,"subscribers_count":3,"default_branch":"main","last_synced_at":"2024-10-11T11:18:42.392Z","etag":null,"topics":["argon2","argon2i","argon2id","go","golang"],"latest_commit_sha":null,"homepage":"https://pkg.go.dev/github.com/matthewhartstonge/argon2","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/matthewhartstonge.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-05-28T11:40:13.000Z","updated_at":"2024-10-08T20:08:08.000Z","dependencies_parsed_at":"2023-12-03T21:23:09.478Z","dependency_job_id":"1a047a6a-ae8d-4c78-b8f0-c941745791e7","html_url":"https://github.com/matthewhartstonge/argon2","commit_stats":null,"previous_names":[],"tags_count":15,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/matthewhartstonge%2Fargon2","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/matthewhartstonge%2Fargon2/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/matthewhartstonge%2Fargon2/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/matthewhartstonge%2Fargon2/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/matthewhartstonge","download_url":"https://codeload.github.com/matthewhartstonge/argon2/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247276164,"owners_count":20912288,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["argon2","argon2i","argon2id","go","golang"],"created_at":"2024-10-10T11:18:53.256Z","updated_at":"2025-10-24T00:41:29.536Z","avatar_url":"https://github.com/matthewhartstonge.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# 🔐 argon2\n\n[![Go Reference](https://pkg.go.dev/badge/github.com/matthewhartstonge/argon2.svg)](https://pkg.go.dev/github.com/matthewhartstonge/argon2) [![Go Report Card](https://goreportcard.com/badge/github.com/matthewhartstonge/argon2)](https://goreportcard.com/report/github.com/matthewhartstonge/argon2) [![go](https://github.com/matthewhartstonge/argon2/actions/workflows/go.yml/badge.svg)](https://github.com/matthewhartstonge/argon2/actions/workflows/go.yml)\n\nargon2 provides a pure Go implementation for Argon2 password hashing.\n\nIntended to be a drop in replacement for lhecker's [argon2](https://github.com/lhecker/argon2)\nlibrary.\n\n## tl;dr\n```go\npackage main\n\nimport (\n    \"fmt\"\n\n    \"github.com/matthewhartstonge/argon2\"\n)\n\n\nfunc main() {\n    argon := argon2.DefaultConfig()\n\n    // Waaahht??! It includes magic salt generation for me ! Yasss...\n    encoded, err := argon.HashEncoded([]byte(\"p@ssw0rd\"))\n    if err != nil {\n        panic(err) // 💥\n    }\n    \n    fmt.Println(string(encoded))\n    // \u003e $argon2id$v=19$m=65536,t=1,p=4$WXJGqwIB2qd+pRmxMOw9Dg$X4gvR0ZB2DtQoN8vOnJPR2SeFdUhH9TyVzfV98sfWeE\n\n    ok, err := argon2.VerifyEncoded([]byte(\"p@ssw0rd\"), encoded)\n    if err != nil {\n        panic(err) // 💥\n    }\n    \n    matches := \"no 🔒\"\n    if ok {\n        matches = \"yes 🔓\"\n    }\n    fmt.Printf(\"Password Matches: %s\\n\", matches)\n}\n```\n\n## Example\nFor a fuller example check out [_example/example.go](./_example/example.go) for \na step-by-step introduction.\n\n```\ngo run _example/example.go\n```\n\n## Limitations\n* `Config.Parallelism` is a `uint8` instead of `uint32` as required by the\n    underlying crypto library\n* The [crypto](https://golang.org/x/crypto/argon2) implementation does not \n    support generation using Argon2d. Argon2id is now generally recommended.\n* Errors still need to be properly implemented at the Go end \n    * This is mainly a case of implementing the PHC/Argon2 C++ pre-hash validation checks.\n\n👌\n\n## Benchmarks\n\nThe following manual benchmark was performed on a `i7-7700 @ 3.60GHz` with \n`AData DDR4 2132MHz` memory.\n\nNote: \n- The native benchmarks are in a separate branch for reference in order to keep\n  go mod dependencies tidy.\n\n```\ngoos: windows\ngoarch: amd64\npkg: github.com/matthewhartstonge/argon2\nBenchmarkHash\nBenchmarkHash-8                               50          23479754 ns/op\nBenchmarkNativeArgonBindingsHash\nBenchmarkNativeArgonBindingsHash-8            38          31814984 ns/op\nBenchmarkVerify\nBenchmarkVerify-8                             49          22755661 ns/op\nBenchmarkNativeArgonBindingsVerify\nBenchmarkNativeArgonBindingsVerify-8          38          32342853 ns/op\nBenchmarkEncode\nBenchmarkEncode-8                        8693931               142 ns/op         604.42 MB/s\nBenchmarkDecode\nBenchmarkDecode-8                        5852835               208 ns/op         414.27 MB/s\nBenchmarkSecureZeroMemory16\nBenchmarkSecureZeroMemory16-8          289155232              4.09 ns/op        3914.11 MB/s\nBenchmarkSecureZeroMemory64\nBenchmarkSecureZeroMemory64-8          284339167              4.21 ns/op       15215.14 MB/s\nBenchmarkSecureZeroMemory256\nBenchmarkSecureZeroMemory256-8         160209489              7.51 ns/op       34093.00 MB/s\nBenchmarkSecureZeroMemory1024\nBenchmarkSecureZeroMemory1024-8         75083060              16.4 ns/op       62457.50 MB/s\nBenchmarkSecureZeroMemory4096\nBenchmarkSecureZeroMemory4096-8         20678958              60.3 ns/op       67922.23 MB/s\nBenchmarkSecureZeroMemory1048576\nBenchmarkSecureZeroMemory1048576-8         52404             22442 ns/op       46724.63 MB/s\nPASS\nok      github.com/matthewhartstonge/argon2     18.481s\n```\n\n## Versioning Strategy\n\nThe API is stable and has been running in production for many years now, therefore won't be changing.\n\nThis library has a single dependency on `golang.org/x/crypto`. This means that as the version of Go is updated there, this library will roll up it's version to a new minor.\nAny CVEs/security patches that come through via dependabot, without a resulting Go version update, will become a patch release.\n\nAs of 2025, `golang.org/x` libraries only support `1.(N-1).0` as their versioning strategy. If you're interested you can read about the implemented [automate go directive maintenance in golang.org/x repositories](https://go.googlesource.com/proposal/+/master/design/69095-x-repo-continuous-go.md) proposal. \n\nFor example:\n\n- If a version of `/x/crypto` now requires `go@1.28.0`, `argon2` will go from `v1.0.0` -\u003e `v1.1.0`.\n- If `x/crypto` releases a version that resolves CVEs with no requirement to upgrade Go, then `argon2` will go from `v1.0.0` -\u003e `v1.0.1`.","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmatthewhartstonge%2Fargon2","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmatthewhartstonge%2Fargon2","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmatthewhartstonge%2Fargon2/lists"}