- Why would I use `bordoni/phpass` instead of Laravel’s built-in `Hash` facade?
- This package is useful for legacy systems requiring Phpass v0.3 compatibility or custom bcrypt logic not covered by Laravel’s Hash facade. It’s also lightweight if you need to integrate with third-party auth systems that expect Phpass hashes. However, Laravel’s Hash facade is generally preferred for new projects due to its built-in security updates and flexibility.
- Does this package work with Laravel 9/10, or is it limited to older versions?
- The package supports PHP 5.4+, which technically works with Laravel 5.8+, but it’s not actively maintained for newer Laravel versions. Test thoroughly in your environment, especially if using PHP 8.1+ due to a fixed `intval` conversion issue. For Laravel 9/10, consider Laravel’s native `Hash` facade unless you have legacy Phpass dependencies.
- How do I install `bordoni/phpass` in a Laravel project?
- Add it to your `composer.json` under `require` with the dev-main branch: `"bordoni/phpass": "dev-main"`, then run `composer install`. No Laravel-specific setup is needed—just instantiate `PasswordHash` with a cost factor (e.g., `new PasswordHash(8, false)`) and use `HashPassword()`/`CheckPassword()`. Autoloading is handled via Composer.
- Can I mix this package with Laravel’s `Hash` facade in the same project?
- Technically yes, but it’s risky. Both use bcrypt, so hashes are verifiable across them, but inconsistent cost factors or salt handling could cause issues. Use one or the other unless you have a specific need for Phpass’s legacy behavior. For hybrid setups, abstract the choice behind a service container binding or config flag.
- Are the hashes generated by this package compatible with Laravel’s `Hash::check()`?
- Yes, because both use bcrypt with the `$2a$` prefix. However, Laravel’s `Hash::make()` might use a different cost factor (e.g., 10 vs. your configured 8). Verify compatibility by testing hashes generated by this package against Laravel’s `Hash::check()` in your environment.
- What’s the performance impact of using this package vs. Laravel’s `Hash`?
- Performance is nearly identical since both rely on bcrypt. The difference lies in abstraction: Laravel’s `Hash` includes optimizations like algorithm flexibility and key derivation, while this package is a direct Phpass implementation. Benchmark in your specific use case, but expect minimal variance unless you’re hashing millions of passwords.
- Is this package secure for production use in 2024?
- It’s secure *for its purpose*—bcrypt is still robust—but it’s a fork of a 13-year-old library with no active maintenance. Avoid using it for new projects unless you need Phpass-specific features. For production, prefer Laravel’s `Hash` facade or a maintained alternative like `phpass-2.0`. Audit your risk tolerance, especially if relying on fixed PHP 8.1 issues.
- How do I handle password hashing in a Laravel migration or legacy database?
- Use this package to re-hash existing passwords if they’re in Phpass format. For migrations, create a seed or console command to update hashes using `PasswordHash::HashPassword()`. Example: `User::where('password', 'like', '$P$%')->get()->each(fn($user) => $user->update(['password' => $hasher->HashPassword($user->password)]));`
- Are there alternatives to this package for Laravel projects?
- Yes: Laravel’s native `Hash` facade (recommended), `phpass-2.0` (actively maintained fork), or `phpass-compat` for modern PHP. If you need Phpass v0.3 specifically, this package is the only fork available, but weigh the maintenance risk. For new projects, avoid legacy hashing libraries unless absolutely necessary.
- How do I test this package in a Laravel application before production?
- Write unit tests for `HashPassword()` and `CheckPassword()` using PHPUnit, covering edge cases like empty strings, non-ASCII passwords, and malformed hashes. Mock the `PasswordHash` class in Laravel’s service container to isolate testing. Example: `PasswordHash::shouldReceive('CheckPassword')->once()->andReturn(true);` in a feature test.