Argon2 password conversion

Passwords are saved as hashes in the database. Argon2 is among the strongest hashing methods currently available, meaning it requires a great amount of computation power to brute force.

Converting existing passwords to use Argon2 hashing can be done through an action in the backstage of your application. To gain access to this action, contact Crossmarx.

Argon2 password hashing requires a 'pepper' file to be present in the application, and each password to be 'salted'. The action takes care of both.

Using the action, if there is no pepper file present yet, you will be prompted to create one. 

If there is a pepper file present, you can start converting existing passwords to use Argon2. This process can be stopped and restarted at any point. Passwords that have been converted will use Argon2, those that have not been converted yet, will still use the previous hashing method.

This conversion may take a while (around 1 second per password) and may use up many resources. Take this into account when planning this conversion.

Note that once a pepper file has been created, new passwords will automatically be hashed with Argon2.