- How do I install cr/hashcli in a Laravel project?
- Install it as a dev dependency with composer require --dev cr/hashcli and run the binary at vendor/bin/hashcli. There is no service provider, facade, config file, or Artisan registration to publish, so installation is limited to Composer and the executable. Because it is a standalone PHP CLI binary, it does not need to be loaded into your application kernel at all.
- Does cr/hashcli register an Artisan command I can call with php artisan?
- No. cr/hashcli is a standalone PHP CLI binary rather than a Laravel library, so it does not register any Artisan commands or facades. You invoke it directly through vendor/bin/hashcli from your shell, scripts, or CI jobs. If you want an artisan-style entry point, you would have to write your own thin command that shells out to it.
- Which hashing algorithms does cr/hashcli support?
- It wraps PHP's native password_hash() API, so it supports any algorithm that function exposes, including bcrypt and argon2i or argon2id where available. You can pass cost and options for the bcrypt and argon2 drivers on the command line. If you need generic hash() digests rather than password hashes, verify in --help whether those are exposed before relying on them.
- Can I use cr/hashcli for hashing passwords inside my application at runtime?
- It is not designed for that. It is an out-of-process developer and ops tool, so using it in request paths, queue workers, or anything on the authentication critical path means paying process-spawn overhead for something Laravel's Hash facade already does natively. Keep Hash::make() and Hash::check() in your application code and reserve cr/hashcli for terminal, seeder, and deployment workflows.
- How do I verify a plaintext value against an existing hash with cr/hashcli?
- Pass the plaintext and the stored hash to the CLI's verify operation and check the exit code rather than scraping the printed text. That keeps your scripts robust if the human-readable output changes between versions. A nonzero exit code on mismatch or failure is the reliable signal to branch on.
- Is it safe to pass passwords or tokens as command-line arguments to cr/hashcli?
- Command-line arguments are visible in process listings such as ps, so passing secrets via argv risks leaking them to other users on the same host. Pipe values through stdin instead where the tool supports it, and avoid embedding secrets in shell history or CI logs. Wrapping the invocation in your own adapter helps enforce stdin usage and consistent escaping.
- Which PHP and Laravel versions does cr/hashcli require?
- Because it is a plain PHP CLI binary rather than a Laravel package, it has no Laravel framework constraint to inherit. The practical requirement is that the CLI runtime matches your application runtime, including the same PHP major and minor version and the same extensions such as sodium if you use argon2. Check the package's composer.json for the declared PHP floor before adopting it.
- Can cr/hashcli be used in CI pipelines and deployment scripts?
- Yes, it is described as script-friendly, which makes it reasonable for fixture generation, checksum jobs, and integrity checks in CI. Pin a specific version or commit, rely on exit codes rather than parsing human-readable output, and add known-answer tests so behavior changes are caught. Wrap the call in an adapter or internal helper instead of scattering shell_exec calls through your seeders and deploy scripts.
- Is cr/hashcli actively maintained and safe to depend on for production workflows?
- Public signals are weak: very few stars, no dependents, a single maintainer, and no visible release cadence, which is a meaningful concern for a security-adjacent tool. Read the source to confirm it only wraps native password_hash() and password_verify() and contains no bespoke crypto logic. Many teams treat it as a reference implementation and instead vendor a pinned copy or write a small internal equivalent they own.
- What are the alternatives to cr/hashcli for hashing in a Laravel project?
- Laravel's Hash facade and PHP's native password_hash(), password_verify(), and hash() functions already cover in-app hashing without any extra dependency. For one-off terminal work you can also use php -r or php artisan tinker, or write a roughly thirty-line internal command that does exactly what you need. Those options avoid inheriting maintenance and supply-chain risk from a low-adoption package.