Weave Code
Hash Laravel Package
php-standard-library/hash
Cryptographic and non-cryptographic hashing for PHP with an Algorithm enum, timing-safe comparison, and HMAC support.
PHP Standard Library - Hash provides a unified, type-safe API for cryptographic and non-cryptographic hashing in PHP. It wraps native hashing functions behind a clean interface, exposing supported algorithms through a HashAlgorithm enum for autocompletion and static analysis.
- Algorithm enum for discoverable, type-safe algorithm selection
- HMAC generation and verification with any supported algorithm
- Timing-safe comparison to prevent side-channel attacks
- Cryptographic and non-cryptographic hashing via one consistent API
- Seamless integration with the broader PHP Standard Library ecosystem
Frequently asked questions about Hash
- How do I install php-standard-library/hash in a Laravel project?
- Install it with Composer by running composer require php-standard-library/hash. The package is framework-agnostic, so you can use it directly in Laravel 10 or 11 on PHP 8.1+ without a service provider. If you want a Laravel-style API, wrap it in a small service provider or bind it in the container.
- Does php-standard-library/hash support Laravel 10 and Laravel 11?
- Yes, the evaluation notes compatibility with Laravel 10 and 11 on PHP 8.1+. It is modular and framework-agnostic, so it does not conflict with Laravel's core Hash facade or ext-hash. Check the package's Composer constraints before upgrading Laravel or PHP.
- Should I replace Laravel's Hash facade with this package for passwords?
- No. Keep Laravel's Hash facade for password hashing and use php-standard-library/hash for non-password data such as checksums, cache keys, API signatures, and HMACs. The evaluation recommends documenting that boundary to avoid confusion and maintainability issues.
- What hashing algorithms does the Algorithm enum cover?
- The package exposes an Algorithm enum for cryptographic and non-cryptographic hashing. The provided evaluation lists SHA-256 and BCRYPT as cryptographic examples and MD5 and CRC32 as non-cryptographic examples. It does not claim support for every algorithm such as SHA-3 or BLAKE3, so confirm your required algorithms in the package documentation.
- How do I create and verify an HMAC with php-standard-library/hash?
- The package includes HMAC support as part of its hashing API. You select the underlying algorithm with the Algorithm enum, generate the HMAC with your secret key, and store or transmit the result. Verify incoming HMACs with the package's timing-safe comparator instead of a normal string equality check.
- Why should I use HashComparator instead of comparing hashes with ===?
- HashComparator provides timing-safe comparison for hashes, tokens, and API keys. Normal equality checks can leak timing information that attackers may exploit in sensitive verification paths. Use the comparator anywhere an attacker could submit a value to be checked against a secret hash.
- Can php-standard-library/hash be used for checksums and cache keys?
- Yes, its non-cryptographic algorithms such as MD5 and CRC32 are suitable for checksums, cache keys, and other non-security-sensitive identifiers. Do not use non-cryptographic hashes for passwords, signatures, or token verification. For high-throughput checksum workloads, benchmark it against native hash() first.
- Is php-standard-library/hash a drop-in replacement for PHP's hash() function?
- It offers a consistent API with an Algorithm enum, HMAC support, and timing-safe comparison, which can replace ad-hoc hash() calls in many Laravel workflows. The evaluation notes minimal overhead for most use cases but recommends benchmarking native hash() for high-throughput paths. Keep native hash() as a fallback if the package becomes unsustainable.
- How should I test php-standard-library/hash in CI?
- Add unit tests for hash generation, HMAC creation and verification, and HashComparator behavior. Include edge cases such as empty strings, binary data, and known test vectors, and test that invalid HMACs are rejected. Avoid relying on exact timing measurements in CI; test the comparator's correctness and usage instead.
- What are the maintenance risks and alternatives to php-standard-library/hash?
- The evaluation flags low community engagement, including 0 stars, as a long-term sustainability risk. Plan a fallback to native PHP hash(), Symfony SecurityComponent, paragonie/hmac, or ext-sodium if the package stagnates. Use feature flags or a small wrapper so you can switch implementations without rewriting application code.
Weaver
How can I help you explore Laravel packages today?