Advanced Encoder Bundle Laravel Package

Product Decisions This Supports

• Build vs. buy on authentication internals. This package is not a viable purchase/adoption candidate (archived, last release 2014, Symfony 2-only, zero dependents), but it is useful evidence: it proves that "one encoder per app" was a real, unmet need in the Symfony ecosystem for years. That gap has since been closed natively (Symfony 4.4+ PasswordHasherFactory, 5.3+ UserPasswordHasherInterface / PasswordUpgraderInterface). The product decision it supports is: build this in-house against supported Symfony primitives, do not vendor this bundle.
• Multi-tenant / per-segment security policy. The instance-basis encoder concept maps directly to a product requirement many B2B/SaaS roadmaps hit: different customer tenants (or user classes: admin, service accounts, federated users) needing different hashing algorithms, cost factors, or compliance-mandated parameters. This bundle is a reference for whether to support per-tenant hashing policy at all — not how to implement it.
• Password migration and algorithm agility roadmap item. The strongest product signal here is the migration use case: legacy bcrypt/ MD5/ SHA1 users being transparently rehashed to Argon2id on next successful login. That is a security-roadmap item with a clear risk narrative (audit findings, compliance, breach impact) and a clear cost (typically 1–2 sprints, no user-facing change).
• Upgrade/technical-debt prioritization. If the team is still on Symfony 2/3 and has hand-rolled or bundled per-instance encoding, this package's archival is a forcing function: it's a reason to scope the framework upgrade, not a library to install.
• Deprecation and dependency-policy precedent. 0 dependents and 30 stars is a useful data point when writing (or enforcing) an internal "no unmaintained security-adjacent dependencies" policy — a concrete example to cite in an ADR.

When to Consider This Package

Adopt only under a very narrow set of conditions — and even then, prefer a fork or a ~50-line custom service:

• You maintain a legacy Symfony 2.x application that cannot be upgraded on the current planning horizon, and you have a genuine per-instance (per-user or per-tenant) encoder requirement, and you have the appetite to own a fork indefinitely.
• You need a read-only design reference for how per-instance encoder selection and user-class-based factories were structured before native support existed.

Look elsewhere — i.e., do not adopt — when:

• You are on Symfony 4.4+ / 5.x / 6.x / 7.x. Use PasswordHasherFactory keyed by user class, UserPasswordHasherInterface for hashing, and implement PasswordUpgraderInterface for migrate-on-login. This is the supported, patched, documented path.
• Security posture matters (it always does for auth). An archived bundle receives no CVE fixes, no PHP 8 compatibility work, and no security review. Supply-chain and maintenance risk outweigh any convenience.
• You need modern hashing (Argon2id, tuned cost factors) or FIDO2/passkeys on the roadmap — this package predates all of it.
• The need is actually one algorithm, one policy. The default framework encoder is already correct; per-instance complexity adds attack surface and testing burden for no product value.

How to Pitch It (Stakeholders)

To executives (30 seconds): We evaluated this package and recommend against adopting it — it's been archived since 2014 and only supports an unsupported Symfony version, so using it in production would be a security and maintenance liability. However, it points at a real capability gap we should address: the ability to use different password-hashing policies for different customers and to automatically upgrade users' stored passwords to stronger hashing on login. Modern Symfony supports this natively, so this is a small, contained engineering item (~1–2 sprints) with no user-visible change, and it materially reduces our exposure in a breach and our friction in security reviews. Recommendation: close this evaluation, open a roadmap item for "password hashing agility and migrate-on-login," and ship it on supported framework primitives.

To engineering (short form): Do not add friendsofsymfony/advanced-encoder-bundle to composer.json. It targets Symfony 2, is archived, has no releases since 2014 and zero dependents. The requirement it addressed — selecting an encoder per user instance — is now handled by PasswordHasherFactory with a user-class/tenant resolver plus PasswordUpgraderInterface for transparent rehash on successful authentication. If we still have Symfony 2 code paths relying on this pattern, that's an argument for prioritizing the framework upgrade; treat this bundle as a design reference only, and if we must support it short-term, fork and pin it with an explicit owner and removal date.