title: Argon2 library that hashes passwords without a secret and with a random salt that doesn't appear parseable
body: <p>I am looking at different alternatives to hash passwords in a Python app. First I was settling for Flask-bcrypt (<a href="https://github.com/maxcountryman/flask-bcrypt" rel="noreferrer">https://github.com/maxcountryman/flask-bcrypt</a>), but then decided to use Argon2. The most popular Argon2 bindings for Python is argon2-cffi  (<a href="https://github.com/hynek/argon2-cffi" rel="noreferrer">https://github.com/hynek/argon2-cffi</a>).</p>
  
  <p>According to its' docs (<a href="https://argon2-cffi.readthedocs.io/en/stable/api.html" rel="noreferrer">https://argon2-cffi.readthedocs.io/en/stable/api.html</a>), all I need to do is use 3 methods:</p>
  
  <ul>
  <li><code>hash</code> to hash a password</li>
  <li><code>verify</code> to compare a password to a hash</li>
  <li><code>check_needs_rehash</code> to see if a password should be rehashed after a change in the hashing parameters</li>
  </ul>
  
  <p>Two things puzzle me.</p>
  
  <p>1) The salt is random, using <code>os.urandom</code>. I thus wonder if the <code>verify</code> method is somehow able to extract the salt from the hash? Or in other words, since I have no say in what the salt is and cannot save it, how can the <code>verify</code> method actually ever compare any password to a password that was hashed with a random salt? Am I supposed to somehow parse the salt from the return value of <code>hash</code> myself, and store it separately from the hashed value? Or is the hash supposed to be stored as is in the docs, untouched, and somehow Argon2 is capable of verifying a password against it? And if indeed Argon2 can extract the salt out of the hash, how is using a salt any safer in that case since a hostile entity who gets a hashed password should then also be able to extract the salt?</p>
  
  <p>2) By default I do not supply any secret to the <code>hash</code> method and instead the password itself seems to be used as a secret. Is this secure? What are the downsides for me not supplying a secret to the hashing method?</p>