Class Pepper

Namespace

Argon2id.PasswordHasher

Assembly

Argon2id.PasswordHasher.dll

A named secret key ("pepper") mixed into every Argon2id hash. A pepper is an application-level secret kept outside the password database (for example in a key vault or environment variable). If the database leaks but the pepper does not, the stolen hashes cannot be cracked offline.

public sealed class Pepper

Inheritance

object

Pepper

Remarks

The Id is stored in the hash (as the PHC keyid parameter) so verification can select the right pepper; the Argon2id.PasswordHasher.Pepper.Key bytes are never stored. Rotate peppers over time by introducing a new active pepper and keeping retired ones in a PepperRing so existing hashes still verify.

Constructors

Pepper(string, byte[])

Creates a pepper.

public Pepper(string id, byte[] key)

Parameters

id string

A short, stable identifier (e.g. "2026-05"). Must be non-empty. This value is embedded in every hash produced with the pepper, so never change the bytes of an existing id — introduce a new id instead.

key byte[]

The secret key bytes. Must be at least 16 bytes (128 bits).

Exceptions

ArgumentException

id is null or empty.

ArgumentNullException

key is null.

ArgumentOutOfRangeException

key is shorter than 16 bytes.

Properties

Id

The stable identifier embedded in hashes produced with this pepper.

public string Id { get; }

Property Value

string