New in Symfony 5.3: PasswordHasher Component

Contributed by Robin Chalas in #39802

Hashing passwords is the process of applying a cryptographic hash function to transform the original plain text password into a different non-guessable value which is infeasible to invert.

For historical reasons, Symfony uses the term "password encoding" when it should really refer to "password hashing". This has caused some confusion for people learning Symfony, so we decided to fix this in Symfony 5.3 for once and for all.

That's why in Symfony 5.3 we're introducing a new component called PasswordHasher. This component extracts all the existing code and features related to "password encoding" and renames it to "password hashing". All the "encoding" features are deprecated in Symfony 5.3 and will be removed in Symfony 6.0.

The API of the new hasher is similar to the previous one and slightly more close to the PHP built-in password hashing API:

1
2
3
4
5
6
7
8
9
10

namespace Symfony\Component\PasswordHasher;

interface PasswordHasherInterface
{
    public function hash(string $plainPassword): string;

    public function verify(string $hashedPassword, string $plainPassword): bool;

    public function needsRehash(string $hashedPassword): bool;
}

This new component can be used independently from the rest of Symfony features in any PHP application. For existing Symfony applications, the new component is included automatically when installing/updating the security package, so you don't need to make any change in your dependencies.

The impact in your application code will be low, but you might need to make some minor changes. For example, the security:encode-password command is now called security:hash-password. The security.password_encoder service is now called security.password_hasher, the UserPasswordEncoderInterface is now UserPasswordHasherInterface, etc.

The main change will be in the security configuration, where you need to replace encoders by password_hashers:

1
2
3
4
5

# config/packages/security.yaml
-encoders:
+password_hashers:
     App\Entity\User:
         algorithm: 'auto'