New in Symfony 5.3: PasswordHasher Component

Symfony 5.3 is backed by JoliCode. JoliCode is a team of passionate developers and open-source lovers, with a strong expertise in PHP & Symfony technologies. They can help you build your projects using state-of-the-art practices.

Contributed by
Robin Chalas
in #39802.

Hashing passwords is the process of applying a cryptographic hash function to transform the original plain text password into a different non-guessable value which is infeasible to invert.

For historical reasons, Symfony uses the term “password encoding” when it should really refer to “password hashing”. This has caused some confusion for people learning Symfony, so we decided to fix this in Symfony 5.3 for once and for all.

That’s why in Symfony 5.3 we’re introducing a new component called PasswordHasher. This component extracts all the existing code and features related to “password encoding” and renames it to “password hashing”. All the “encoding” features are deprecated in Symfony 5.3 and will be removed in Symfony 6.0.

The API of the new hasher is similar to the previous one and slightly more close to the PHP built-in password hashing API:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
namespace Symfony\Component\PasswordHasher;

interface PasswordHasherInterface
{
    public function hash(string $plainPassword): string;

    public function verify(string $hashedPassword, string $plainPassword): bool;

    public function needsRehash(string $hashedPassword): bool;
}

This new component can be used independently from the rest of Symfony features in any PHP application. For existing Symfony applications, the new component is included automatically when installing/updating the security package, so you don’t need to make any change in your dependencies.

The impact in your application code will be low, but you might need to make some minor changes. For example, the security:encode-password command is now called security:hash-password. The security.password_encoder service is now called security.password_hasher, the UserPasswordEncoderInterface is now UserPasswordHasherInterface, etc.

The main change will be in the security configuration, where you need to replace encoders by password_hashers:

1
2
3
4
5
 # config/packages/security.yaml
-encoders:
+password_hashers:
     App\Entity\User:
         algorithm: 'auto'
Help the Symfony project!

As with any Open-Source project, contributing code or documentation is the most common way to help, but we also have a wide range of sponsoring opportunities.

Comments

why "PasswordHasher" component and "PasswordHasherInterface" and not "Hasher" component and "Hash[er]Interface" ? tokens can be hashed as well, etc... it seems to me this component's name can be generalized
@nopcea I think the name of the component was influenced by the name of the PHP function it relies on: password_hash (https://www.php.net/manual/fr/function.password-hash.php)
:tada::tada::tada:
Excellent!
> why "PasswordHasher"?

Good question. Actually, not all hash functions are suitable for hashing passwords. For example, BLAKE 3 is not.
Login with SymfonyConnect to post a comment