Can someone explain to me what the ArgonHashString function in libsodium returns (i'm using the .net port).

For example i called it twice with the same string:

var foo1 = PasswordHash.ArgonHashString("f");
var foo2 = PasswordHash.ArgonHashString("f");

and i got entirely different answers:

  • $\begingroup$ pythonhosted.org/passlib/modular_crypt_format.html $\endgroup$ Sep 9, 2016 at 17:35
  • 4
    $\begingroup$ The reason you get two answers seems to be that the function is generating a different salt on each call. I should say I am weirded out by all those "\0" chars at the end. $\endgroup$ Sep 9, 2016 at 17:40
  • $\begingroup$ the whole bunch of NULs is probably the library or the .net port filling the entire thing up with NULs so the string always has a constant length. due to the fact that there are parameters like memory, time and parallelization, the length of the entire string isnt always the same. $\endgroup$
    – My1
    Jul 11, 2018 at 9:22

2 Answers 2


This function returns a string that the verification function will consider valid when given the same password.

You shouldn't have to care about what the string actually contains. If only because the default algorithm and parameters can change. But the guarantee above will always be true.

But indeed, the string will be different if given the same password twice. It includes some randomness, so that by observing the hashed passwords of a user database, you can't tell that user1 and user2 share the same password.


ArgonHashString calls the libsodium function crypto_pwhash_str which automatically generates a salt value that is part of the result.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.