Hashing

• Introduction
• • Hashing Passwords
  • Determining If A Password Needs To Be Rehashed

Bcrypt is a great choice for hashing passwords because its “work factor” is adjustable, which means that the time it takes to generate a hash can be increased as hardware power increases. When hashing passwords, slow is good. The longer an algorithm takes to hash a password, the longer it takes malicious users to generate “rainbow tables” of all possible string hash values that may be used in brute force attacks against applications.

The default hashing driver for your application is configured in your application’s config/hashing.php configuration file. There are currently several supported drivers: and Argon2 (Argon2i and Argon2id variants).

Adjusting The Bcrypt Work Factor

If you are using the Bcrypt algorithm, the method allows you to manage the work factor of the algorithm using the rounds option; however, the default work factor managed by Laravel is acceptable for most applications:

Adjusting The Argon2 Work Factor

If you are using the Argon2 algorithm, the make method allows you to manage the work factor of the algorithm using the memory, , and threads options; however, the default values managed by Laravel are acceptable for most applications:

The check method provided by the Hash facade allows you to verify that a given plain-text string corresponds to a given hash:

The method provided by the Hash facade allows you to determine if the work factor used by the hasher has changed since the password was hashed. Some applications choose to perform this check during the application’s authentication process: