juanchosl / password-hashing

1.0.x-dev 2026-09-17 20:00 UTC

Requires

• php: ^8.0
• juanchosl/datamanipulation: ^1.0

Requires (Dev)

• doctrine/instantiator: 1.5.*
• phpstan/phpstan: 1.12.*
• phpunit/phpunit: 9.6.*

MIT

• Juan Sánchez Lecegui

• security
• password
• hash
• crypt
• hashing
• MD5
• sha
• apr

Published on Packagist.org on 2026-09-17 20:00 UTC

README

Description

This library provides an abstraction layer in order to hash and verify given client passwords using some crypt and password hashing functions, in order to unify the creation and validation implementing interfaces

Install

composer require juanchosl/password-hashing

Available hashings

• BCrypt, Argon2I, Argon2ID Password hashing
• MD5, DES (standard and extended), Blowfish, SHA256, SHA512 Crypt
• Digest created with any hash algorithm included into hash_algos() function: Hash
• PBKDF2 derivation created with any hash hmac algorithm included into hash_hmac_algos() function: hash_pbkdf2
• Sha1 (Apache Sha1), the apache implementation for his authentication module on Basic authentication > BASE64 of SHA1 binary password digest, with a prepenned {SHA} string
• APR1 (Apache MD5), an owned algorithm for his authentication module on Basic authentication > always 1000 iterations over a random salt
• Apache Digest MD5, the apache implementation for his authentication module onDigest authentication

How use it

For use, we allways are starting with a plain given password, sended by the user. Using this plain text, we need to creates an instance of our used object to saved the hashed passwords

Hash a plain password

To hash a given password, we only needs cast to string the plain given password, and save the hash to into our database

$hasher = new ArgonI($sended_password);
$hash = (string) $hasher;

Verify a given password

When an user needs to login, we creates an instance with the given password after verify that the user exists and is enabled. Then only needs to invoke the previously created object, with the prior saved hash extracted from database as parameter, in order to verify that it has been created with the same password, and returning a boolean indicating the verification result.

$database_hash = (new UserDatabase)->select("password")->where("username", $passed_username, '=')->hashed_password;

$hasher = new ArgonID($sended_password);
$validation_result = $hasher($database_hash);//true or false

Extra parameters

Some modules, have a extra parameters in order to hash the passwords, has number of iterations, a salt to ensure the security, or a list of algorithms to use

Module	Algorithm	Salt	Iterations	Length	Output
Password		X			BASE64
Hash	X				HEXADC
Hmac					HEXADC
Crypt MD5		X			BASE64
Crypt std		X			BASE64
Crypt		X	X		BASE64
Apache APR					BASE64
Apache SHA					BASE64
Apache MD5					HEXADC