Is there a way to specify in Craft 3 which hashing algorithm should passwords use? I know craft 3 uses PHP's password_hash() function, my question is: is there a way of modifying the 2nd and 3rd parameter of that function via a craft config.

I'm trying to find a way of doing this without using a separate/custom column in the users table.

Thank you.

  • You're looking to use PASSWORD_ARGON2I instead of bcrypt? – Brad Bell Jun 21 '18 at 18:48

The 3rd parameter for the hash cost you can control via the blowfishHashCost config setting.

The 2nd parameter (for the algorithm) is a bit more difficult because it's not exposed via a config setting. I assume you want to use PASSWORD_ARGON2I since that and PASSWORD_BCRYPT (the default) are the only two options: https://secure.php.net/manual/en/function.password-hash.php

You'd need to create a custom Application Config component that overrode Craft's security component with your own Security class. Your own class could extend Craft's an overwrite just the hashPassword method, or any others that you might need to.

  • The 3rd parameter doesn't only consist of the cost, if I want to customize the salt generation, Craft doesn't provide a config for that. So the best way to do this is indeed to rewrite the Security class. – dustfeather Jun 28 '18 at 12:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.