New in Symfony 3.4: Argon2i password hasher

Contributed by
Zan Baldwin
in #21604.

Symfony recommends to use the Bcrypt password hasher to hash the passwords of your applications. Bcrypt was specifically designed for long-term password storage and it's natively supported by PHP.

However, security is a fast-moving field where new best practices and recommendations emerge continuously. In recent months, Argon2 hashing algorithm popularity has exploded, especially since winning the 2015 Password Hashing competition. In fact, PHP 7.2 (to be released at the end of 2017) includes built-in support for Argon2.

That's why we decided to include an Argon2i password hasher in Symfony 3.4. First, if you don't use PHP 7.2, add support for Argon2 installing the Libsodium PHP extension in your server or adding the libsodium-php library to your project. Then, use argon2i as the algorithm of the password hasher:

# app/config/security.yml
    # ...

            algorithm: 'argon2i'

In existing applications using Bcrypt with a reasonably high hashing cost, there's no immediate need to rehash all the passwords using Argon2i. However, if you are creating a new project, you could consider using this new password hashing algorithm.

Help the Symfony project!

As with any Open-Source project, contributing code or documentation is the most common way to help, but we also have a wide range of sponsoring opportunities.


Is there stats (speed, security lvl etc?)
Thanks ,
@Clement Roupioz,
Are the links to the Libsodium PHP extension and the libsodium-php library mixed up? Because "Libsodium PHP extension" links to "Sodium Compat" which is a php polyfill library that cannot be installed in a server while the "libsodium-php library" is an actual PHP extension that needs to be installed in a server and cannot be simply added to a project.
@Ulf thanks for reporting this issue. I've just fixed it.
When using Bcrypt, it is recommended to use PHP generated salt. Is it same with Argon2i?
@Lýdia that's correct! We even created a new interface called SelfSaltingEncoderInterface for those encoder/hasher which don't need a user provider salt. Both Bcrypt and Argon2i encoders/hashers implement that interface.


Comments are closed.

To ensure that comments stay relevant, they are closed for old posts.