Class Argon2idOptions

Namespace

Argon2id.PasswordHasher

Assembly

Argon2id.PasswordHasher.dll

Tunable Argon2id work-factor parameters used when hashing passwords.

public sealed record Argon2idOptions

Inheritance

object

Argon2idOptions

Remarks

The defaults are opinionated and chosen to be safe for typical 2026 server hardware while leaving headroom for concurrent logins. They comfortably exceed the OWASP minimum (Argon2id, 19 MiB, t=2, p=1) and follow the RFC 9106 second recommended profile shape.

Every hash produced by this library stores its own parameters inside the resulting PHC string, so changing these values never breaks verification of existing hashes. Use NeedsRehash(string) to detect and transparently upgrade older hashes on the next successful login.

Properties are settable to support the standard .NET Options pattern (IOptions<TOptions>) and binding from IConfiguration. Hashers treat their options as effectively immutable once constructed — do not mutate an Argon2idOptions instance after passing it to a hasher.

Properties

DegreeOfParallelism

Degree of parallelism (number of lanes / threads). Default: 1. Kept low so per-hash CPU cost is predictable under concurrent load.

public int DegreeOfParallelism { get; set; }

Property Value

int

HashSizeBytes

Derived hash (tag) length in bytes. Default: 32 (256 bits).

public int HashSizeBytes { get; set; }

Property Value

int

Iterations

Time cost: the number of passes over memory. Default: 3.

public int Iterations { get; set; }

Property Value

int

MemorySizeKib

Memory cost in kibibytes (KiB). Default: 65536 KiB (64 MiB). Memory hardness is Argon2's primary defense against GPU/ASIC cracking.

public int MemorySizeKib { get; set; }

Property Value

int

Recommended

The library's recommended defaults. Equivalent to new Argon2idOptions().

public static Argon2idOptions Recommended { get; }

Property Value

Argon2idOptions

SaltSizeBytes

Salt length in bytes. Default: 16 (128 bits), the RFC 9106 recommendation.

public int SaltSizeBytes { get; set; }

Property Value

int

Methods

Validate()

Validates the parameter set, throwing System.ArgumentOutOfRangeException for any value outside the safe operating range.

public void Validate()

Remarks

Lower bounds reflect the OWASP / RFC 9106 minimums — below these the configuration would be insecure rather than merely slow. Upper bounds mirror the resource-safety caps the PHC parser enforces during verification, so this library can never emit a hash its own parser would reject.