PasswordHasherInterface
Thin contract over PHP’s password_hash() family, so FormLoginAuthenticator/HttpBasicAuthenticator (both in the future packages/auth) depend on an interface rather than the global functions directly.
Default implementation: argon2id, bcrypt fallback.
Synopsis
Section titled “Synopsis”interface PasswordHasherInterface
| Implemented by | DefaultPasswordHasher |
| Since | 1.0.0 |
| Source | Security/Auth/PasswordHasherInterface.php |
Methods
Section titled “Methods”| Method | Description |
|---|---|
hash(string $plaintext): string | |
needsRehash(string $hash): bool | True if $hash was produced with weaker-than-current-default parameters (algorithm/cost) and should be re-hashed on next successful verify. |
verify(string $plaintext, string $hash): bool |
hash()
Section titled “hash()”abstract public function hash(string $plaintext): string
The plaintext password to hash.
| Parameter | Type | Description |
|---|---|---|
$plaintext | string | The plaintext password to hash. |
Returns string — The resulting hash, suitable for storage.
needsRehash()
Section titled “needsRehash()”abstract public function needsRehash(string $hash): bool
True if $hash was produced with weaker-than-current-default parameters (algorithm/cost) and should be re-hashed on next successful verify.
A previously-stored hash (see hash()).
| Parameter | Type | Description |
|---|---|---|
$hash | string | A previously-stored hash (see hash()). |
Returns bool — True if $hash should be re-hashed, otherwise false.
verify()
Section titled “verify()”abstract public function verify(string $plaintext, string $hash): bool
A previously-stored hash (see hash()).
| Parameter | Type | Description |
|---|---|---|
$plaintext | string | The plaintext password to check. |
$hash | string | A previously-stored hash (see hash()). |
Returns bool — True if $plaintext matches $hash, otherwise false.