Argon2 Memory Cost Calculator
Argon2 derives a key from a password using a large block of memory per hash, which is what makes it resistant to GPU and ASIC cracking. The peak memory footprint of one derivation equals the memory cost parameter m, expressed in kibibytes. To size a login server you need to know that footprint in usable units and how many concurrent derivations your available RAM can sustain during a login burst. This calculator converts the memory cost into mebibytes and gibibytes per hash and divides your server RAM to give a safe concurrency ceiling.
Argon2 memory formula
Per-hash mebibytes = memory cost m / 1,024
Per-hash gibibytes = memory cost m / 1,048,576
Usable RAM (GiB) = server RAM * (1 - reserve fraction)
Concurrent hashes = floor(usable RAM GiB / per-hash gibibytes)
One kibibyte is 1,024 bytes; one mebibyte is 1,024 KiB; one gibibyte is 1,024 MiB. The reserve fraction sets aside RAM for the operating system and other processes.
Argon2 sizing context
- Argon2 is specified in RFC 9106 and won the Password Hashing Competition.
- RFC 9106 reference settings include 2 GiB with one pass, or 64 MiB with three passes, both with parallelism four.
- Peak memory per hash is fixed by m; the time cost t and parallelism p change run time, not footprint.
- Size memory cost and your connection pool together so a login burst cannot exhaust RAM.
- Memory hardness is what defeats cheap GPU and ASIC parallelism that undermines CPU-only functions.
Argon2 memory: frequently asked questions
What is Argon2?
Argon2 is a memory-hard password hashing function specified in RFC 9106 and the winner of the Password Hashing Competition. It is tuned by three parameters: memory cost (m, in kibibytes), time cost (t, the number of passes), and parallelism (p, the number of lanes). Memory hardness forces an attacker to spend RAM per guess, which resists GPU and ASIC acceleration.
How much memory does one Argon2 hash use?
Argon2 allocates memory cost m kibibytes per hash. One kibibyte is 1,024 bytes, so a memory cost of 65,536 KiB equals 64 mebibytes per hash. The time cost and parallelism affect run time but not the peak memory footprint, which is set by m.
How many concurrent hashes can my server handle?
Divide available RAM by the per-hash memory footprint. With 4 gibibytes free and a 64 mebibyte memory cost, you can run about 64 concurrent derivations before exhausting RAM. Size your memory cost and connection pool together so peak login bursts do not exhaust memory.
What parameters does RFC 9106 recommend?
RFC 9106 gives two reference settings: a high-memory option of 2 gibibytes with one pass, and a low-memory option of 64 mebibytes with three passes, both with parallelism degree four. Choose based on the RAM you can dedicate and the latency your logins tolerate, then verify on your own hardware.
Why is memory hardness important?
CPU-only functions like PBKDF2 are cheap to parallelize on GPUs and ASICs because they need almost no memory. Argon2 forces each guess to occupy a large block of RAM, so an attacker's hardware is bottlenecked on memory bandwidth and capacity, which is far more expensive to scale than raw compute.
Official sources
Reviewed by the CalculatorHub team, edited by James Graham, 17 June 2026. See our methodology.