# Why do two Argon hashes with the same password differ?

Can someone explain to me what the ArgonHashString function in libsodium returns (i'm using the .net port).

For example i called it twice with the same string:

var foo1 = PasswordHash.ArgonHashString("f");
var foo2 = PasswordHash.ArgonHashString("f");


and i got entirely different answers:

"$argon2i$v=19$m=32768,t=4,p=1$rKEPCGqfhm7zQt8c2QBhRA$7oZHFjWhHdVg/31SottxDyVM5KA9+4IBc5qD5m9DNFI\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" "$argon2i$v=19$m=32768,t=4,p=1$o8MmGW+GoaVcQvBfmPDE8A$3mHVQbZz3JuLI++MIBC4JOI+/G2oVtq75Jbqml8lbEM\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"

• pythonhosted.org/passlib/modular_crypt_format.html – Luis Casillas Sep 9 '16 at 17:35
• The reason you get two answers seems to be that the function is generating a different salt on each call. I should say I am weirded out by all those "\0" chars at the end. – Luis Casillas Sep 9 '16 at 17:40
• the whole bunch of NULs is probably the library or the .net port filling the entire thing up with NULs so the string always has a constant length. due to the fact that there are parameters like memory, time and parallelization, the length of the entire string isnt always the same. – My1 Jul 11 '18 at 9:22

## 2 Answers

This function returns a string that the verification function will consider valid when given the same password.

You shouldn't have to care about what the string actually contains. If only because the default algorithm and parameters can change. But the guarantee above will always be true.

But indeed, the string will be different if given the same password twice. It includes some randomness, so that by observing the hashed passwords of a user database, you can't tell that user1 and user2 share the same password.

ArgonHashString calls the libsodium function crypto_pwhash_str which automatically generates a salt value that is part of the result.