# Hash a password (/docs/guides/util/hash-a-password)

<!-- agent-signals: reading_time_min: 1 · est_tokens: 348 · updated: 2026-07-28 -->
Related: [Upgrade Bun to the latest version](/docs/guides/util/upgrade.md), [Detect when code is executed with Bun](/docs/guides/util/detect-bun.md), [Get the current Bun version](/docs/guides/util/version.md), [Generate a UUID](/docs/guides/util/javascript-uuid.md), [Encode and decode base64 data](/docs/guides/util/base64.md), [Compress and decompress data with gzip](/docs/guides/util/gzip.md)

Use `Bun.password.hash()` to securely hash passwords. It's built into Bun, with no third-party dependencies.

```ts
const password = "super-secure-pa$$word";

const hash = await Bun.password.hash(password);
// => $argon2id$v=19$m=65536,t=2,p=1$tFq+9AVr1bfPxQdh6E8DQRhEXg/M/...
```

***

By default, `Bun.password.hash()` uses the [Argon2id](https://en.wikipedia.org/wiki/Argon2) algorithm. Pass a second argument to use a different algorithm or configure the hashing parameters.

```ts
const password = "super-secure-pa$$word";

// use argon2 (default)
const argonHash = await Bun.password.hash(password, {
  algorithm: "argon2id",
  memoryCost: 8, // memory usage in kibibytes (minimum 8)
  timeCost: 3, // the number of iterations
});
```

***

Bun also implements the [bcrypt](https://en.wikipedia.org/wiki/Bcrypt) algorithm. Specify `algorithm: "bcrypt"` to use it.

```ts
// use bcrypt
const bcryptHash = await Bun.password.hash(password, {
  algorithm: "bcrypt",
  cost: 4, // number between 4-31
});
```

***

Use `Bun.password.verify()` to verify a password. The hash stores the algorithm and its parameters, so you don't need to specify them again.

```ts
const password = "super-secure-pa$$word";
const hash = await Bun.password.hash(password);

const isMatch = await Bun.password.verify(password, hash);
// => true
```

***

See [`Bun.password`](/runtime/hashing#bun-password).