Hash

Picks the strongest algorithm the running PHP actually supports at call time — Argon2id if the password_hash() build includes it, bcrypt otherwise — rather than hardcoding one that could fall behind as PHP's own defaults evolve.

Methods

Hash::make(string $value, array $options = []): string
Hash::verify(string $value, string $hash): bool          // constant-time internally (PHP's password_verify())
Hash::needsRehash(string $hash, array $options = []): bool // true if $hash used a weaker algorithm/cost than current default

$hash = Hash::make('correct horse battery staple');
// $argon2id$v=19$m=65536,t=4,p=1$...

Hash::verify('correct horse battery staple', $hash); // true
Hash::verify('wrong', $hash);                         // false
Hash::needsRehash($hash);                             // false — just made with current defaults

Check needsRehash() at successful login and re-make() if true — this is exactly how Authentication::attempt()'s $result->needsRehash field works, and why it always runs Hash::verify() exactly once per attempt (against a fixed dummy hash when the identifier doesn't match a real user), so response time never leaks which identifiers exist.

Next steps

• Authentication — the main consumer, including the rehash-on-login pattern.