Weave Code
Password Hasher Laravel Package
symfony/password-hasher
Symfony's PasswordHasher component provides secure password hashing utilities, with a factory to configure multiple algorithms like bcrypt and sodium. Hash plain passwords and verify them easily in your PHP applications.
Symfony PasswordHasher is a standalone component for secure password hashing and verification. It exposes a small, consistent API (hash(), verify(), needsRehash()) across multiple algorithms, letting applications verify existing hashes without rewriting authentication code. Use the PasswordHasherFactory to configure named hashers and select the right one per user context.
Features:
- Pluggable algorithms: bcrypt, sodium (Argon2), PBKDF2, and more
- PasswordHasherFactory for name-based hasher selection
needsRehash()enables transparent upgrades of legacy hashes- Constant-time verification with automatic salt handling
- Framework-agnostic and installable via Composer in any PHP project
Frequently asked questions about Password Hasher
- Is symfony/password-hasher a Laravel package?
- No. It is a Symfony component, not a Laravel package, and Laravel does not consume it by default. Illuminate\Hashing wraps PHP's native password_hash() and password_verify() instead. You can use it in Laravel only as an additive dependency behind a custom Illuminate\Contracts\Hashing\Hasher implementation.
- How do I install symfony/password-hasher in a Laravel app?
- Install it with composer require symfony/password-hasher. Then create a small adapter class that implements Illuminate\Contracts\Hashing\Hasher and delegates hash, verify, and needsRehash to a Symfony PasswordHasherInterface instance. Bind that adapter in a service provider and point your hashing config at it. No database schema change or data migration is required.
- Does Laravel's Hash facade already do what symfony/password-hasher does?
- For single-algorithm bcrypt or Argon2 hashing, yes. Laravel's Hash facade already meets NIST 800-63B and OWASP guidance when you configure a sane cost factor. symfony/password-hasher adds value mainly for multi-algorithm policies, named hashers, and legacy hash migration.
- How do I configure multiple password hashers with PasswordHasherFactory?
- Pass a configuration array to PasswordHasherFactory with named entries such as common using bcrypt and memory-hard using sodium. Retrieve the right hasher by name with getPasswordHasher(), then call hash() and verify() on it. This lets you run per-tenant or per-role algorithm tiers under one API.
- How does needsRehash support transparent password hash rotation in Laravel?
- needsRehash() tells you whether a stored hash was produced with outdated parameters or a different algorithm. In Laravel you can check it after a successful login, typically in a listener on Illuminate\Auth\Events\Login. If it returns true, re-hash the plain password, persist the new hash, and let the user continue without changing their password.
- Can symfony/password-hasher migrate legacy MD5 or SHA-1 password hashes?
- Yes, that is a genuine fit. The component includes MigratingPasswordHasher and LegacyPasswordHasher to verify old hashes and upgrade them on successful login. You still need to wire the rehash-and-persist step yourself and test that pre-existing non-bcrypt rows authenticate correctly.
- Which PHP and Laravel versions does symfony/password-hasher support?
- The 8.x line requires PHP 8.4 or newer, while older Laravel and PHP runtimes need the 6.4 or 7.x line. A mixed-version fleet means pinning multiple minors and managing an upgrade treadmill. Check your PHP version floor across every service before choosing a branch.
- Does symfony/password-hasher require ext-sodium or Argon2 support?
- The sodium hasher depends on ext-sodium or Argon2 support in libsodium being available. Bcrypt does not, but if you configure sodium as a hasher, dev, CI, staging, and production containers all need the extension. A missing extension surfaces as a container-instantiation error, so avoid silently falling back to a weaker hasher in one environment.
- Is symfony/password-hasher safe and actively maintained for production?
- Yes. It is a subtree split of symfony/symfony, reviewed by the Symfony core team, MIT licensed, and used across the Symfony install base. Low star or dependent counts on this split repo are packaging artifacts, not signs of abandonment. Bugs here are security-critical, so roll out with tests, observability, and a rollback path.
- When should I avoid symfony/password-hasher in a Laravel project?
- Avoid it for single-algorithm applications where you already control bcrypt cost through Laravel's Hash config. In that case it adds dependency surface with no behavioural gain. The better alternative is tuning Laravel's built-in hashing driver unless you need multi-algorithm tiers, a legacy hash bridge, or a shared policy across a polyglot platform.
Weaver
How can I help you explore Laravel packages today?