Weave Code
Password Hasher Laravel Package
symfony/password-hasher
Symfony PasswordHasher provides secure password hashing and verification with modern algorithms like bcrypt and sodium. Use PasswordHasherFactory to configure multiple hashers and select the right one for your app’s needs.
Provides password hashing utilities
Frequently asked questions about Password Hasher
- How do I replace Laravel’s default Hash facade with Symfony PasswordHasher without breaking existing auth flows?
- Symfony PasswordHasher is designed for drop-in replacement. Bind the `PasswordHasherFactory` to Laravel’s service container and update your `Hash` facade to use the factory’s hashers. Existing bcrypt hashes remain compatible, and no changes are needed to login/registration logic using `Auth::attempt()` or `Hash::check()`. Start by testing in a staging environment with a subset of users.
- Can I use different hashing algorithms for different user roles (e.g., Argon2id for admins, bcrypt for guests)?
- Yes, the `PasswordHasherFactory` supports role-based hashing. Configure multiple algorithms in the factory (e.g., `['admin' => ['algorithm' => 'argon2id']]`) and retrieve the appropriate hasher using `factory->getPasswordHasher('admin')`. This works seamlessly with Laravel’s authorization systems like Gates or Policies, as the hashing logic is decoupled from user roles.
- What’s the performance impact of switching from bcrypt to Argon2id in Laravel production?
- Argon2id is significantly slower than bcrypt—expect 100–300ms per hash operation under default settings. Benchmark with your infrastructure before deployment, especially for high-traffic endpoints like login. Start with bcrypt for most users, then gradually introduce Argon2id for high-risk roles (e.g., admins) using the factory’s dynamic hasher selection. Monitor response times with Laravel Debugbar or Blackfire.
- How do I detect and rehash legacy hashes (e.g., SHA-1 or plaintext) in a Laravel app using Symfony PasswordHasher?
- Use the `verify()` method to check if a hash is outdated (e.g., SHA-1). If verification fails, rehash the password and update the database. Implement this in a middleware or listener triggered on login. For large-scale migrations, queue the rehashing as a background job to avoid lockouts. Symfony’s auto-rehashing on login mitigates risks, but test thoroughly in staging first.
- Does Symfony PasswordHasher work with Laravel Passport, Sanctum, or other auth packages that rely on the Hash facade?
- Yes, the package is fully compatible with Laravel’s auth ecosystem, including Passport, Sanctum, and Fortify. These packages use Laravel’s `Hash` facade internally, so replacing it with Symfony’s `PasswordHasherFactory` requires no code changes. Test integration by verifying token generation, OAuth flows, and password resets. If issues arise, check for custom hashers in third-party packages and extend the `PasswordHasherFactory` as needed.
- What PHP versions and Laravel releases does Symfony PasswordHasher support?
- The package requires PHP 8.1+ for Symfony 6.4+ or PHP 8.4+ for Symfony 8.0. For Laravel, this aligns with LTS versions 10.x and 11.x. If you’re on Laravel 9.x (PHP 8.0), use Symfony 6.x via Composer constraints (`symfony/password-hasher:^6.0`). Always check the [Symfony docs](https://symfony.com/doc/current/security.html) for version-specific notes, as algorithm support may vary.
- How can I monitor failed password verifications (e.g., legacy hash mismatches) after migrating to Symfony PasswordHasher?
- Log verification failures using Laravel’s logging system. Wrap `PasswordHasher->verify()` in a try-catch block and log the hash algorithm, user ID, and timestamp. For compliance, track these events in a database table or use Laravel’s `Log::channel('security')`. Set up alerts for repeated failures, which may indicate brute-force attempts or migration issues. Tools like Sentry can aggregate these logs for real-time monitoring.
- Can I customize the salting strategy for Symfony PasswordHasher in Laravel?
- Symfony PasswordHasher uses algorithm-specific salting (e.g., bcrypt auto-generates salts). To integrate with existing salting schemes (e.g., per-user salts), extend the `PasswordHasherFactory` and implement a custom `PasswordHasherInterface`. Override the `hash()` method to inject your salt logic. Test thoroughly, as incorrect salting can lead to verification failures. Document your customization for future maintenance.
- What’s the recommended migration path for Laravel apps using deprecated hashing (e.g., SHA-1) to Symfony PasswordHasher?
- Start by detecting deprecated hashes via `Hash::needsRehash()` (for bcrypt) or custom logic for SHA-1. Rehash passwords on login or via a background job, updating the database incrementally. Use feature flags to enable rehashing gradually. For SHA-1, consider a one-time migration script to avoid repeated failures. Always back up your database before migration and test with a subset of users first.
- Are there alternatives to Symfony PasswordHasher for Laravel, and how does it compare?
- Laravel’s built-in `Hash` facade (using PHP’s `password_hash()`) is sufficient for bcrypt but lacks advanced features like algorithm agnosticism or Argon2id support. Alternatives include `php-password-lib` (for custom algorithms) or `paragonie/sodium_compat` (for Sodium/Argon2). Symfony PasswordHasher stands out for its integration with Laravel’s ecosystem, compliance-ready design, and support for multiple algorithms via a single factory. It’s the most future-proof choice for Laravel apps requiring PCI DSS or GDPR compliance.
Weaver
How can I help you explore Laravel packages today?