Question
A password-hash migration can report a successful verification while silently changing the meaning of the input. This project examines fidelity across bcrypt and Argon2 implementations when inputs and encodings are awkward.
Scope
The corpus covers byte-length boundaries, Unicode normalisation, null bytes, input decoding, parser behaviour, and version identifiers. The useful question is not only whether a stack can verify a hash, but whether it verifies the same password bytes under the same policy.
Takeaway
Migration plans should make their input contract explicit, preserve the original verifier for legacy records where necessary, and test difficult cases before treating an import as complete. Encoding behaviour is a security property when it changes authentication semantics.
Public status
This page deliberately avoids publishing a compatibility table before its reproducible cases and implementation versions are packaged for release.