Password hashing lab: Verify and upgrade an Argon2 password hash on login

Create a PasswordHasher with Argon2id at or above m=19456, t=2, p=1. verify() reads the parameters from the stored hash, so it checks old hashes too; your instance’s parameters define the policy for rehashing.

verify() raises VerifyMismatchError on a wrong password and InvalidHashError on an unusable string — both mean authenticated False. After a success, use check_needs_rehash to decide whether to return a fresh hash.

from argon2 import PasswordHasher
from argon2.exceptions import InvalidHashError, VerificationError, VerifyMismatchError


def check_login(stored_hash, password):
    hasher = PasswordHasher(time_cost=2, memory_cost=19456, parallelism=1)
    try:
        hasher.verify(stored_hash, password)
    except (VerifyMismatchError, VerificationError, InvalidHashError):
        return {"authenticated": False, "new_hash": None}
    new_hash = hasher.hash(password) if hasher.check_needs_rehash(stored_hash) else None
    return {"authenticated": True, "new_hash": new_hash}

A PasswordHasher set to Argon2id m=19456, t=2, p=1 verifies the stored hash. A wrong password raises VerifyMismatchError, a bcrypt hash and a malformed string raise InvalidHashError, and all return {"authenticated": False, "new_hash": None}. On success, check_needs_rehash reports true for a hash whose parameters are below the instance’s (the m=512 hash) or whose variant differs (an Argon2i hash), so the function returns a fresh Argon2id hash at the policy minimum; a hash already at the policy strength needs no rehash and new_hash is None. argon2-cffi generates a random 16-byte salt per hash, so no salt handling is needed. The OWASP minimum (Argon2id m=19456, t=2, p=1) and the argon2-cffi defaults (RFC 9106 low-memory: m=65536, t=3, p=4) were both confirmed on 2026-10-11; either is acceptable, and parameters should be raised over time.

Compare it with your own fix, then rerun the tests. The editor is not changed when you open this explanation.

The browser and the lab download run the same cases, including cases that catch common wrong fixes, such as comparing with one fixture value instead of the real rule. The download includes the complete test adapter and cryptographic fixtures.