Skip to content

passwords.md

Latest commit

 

History

History
40 lines (27 loc) · 784 Bytes

passwords.md

File metadata and controls

40 lines (27 loc) · 784 Bytes

Password Hashing

NativePasswordHasher wraps PHP's native password API behind PasswordHasherInterface.

Hash

$hasher = new NativePasswordHasher();
$hash = $hasher->hash($password);

By default the hasher uses PASSWORD_DEFAULT.

Verify

if (!$hasher->verify($submittedPassword, $storedHash)) {
    // Invalid credentials.
}

An empty stored hash returns false.

Rehash

if ($hasher->needsRehash($storedHash)) {
    $storedHash = $hasher->hash($submittedPassword);
}

Use this after successful verification to move old hashes to the current algorithm or options.

Options

$hasher = new NativePasswordHasher(PASSWORD_BCRYPT, ['cost' => 12]);

Invalid algorithms or option errors are wrapped in PasswordHashException.