Authentication
Password Hashing
Argon2id password hashing with automatic rehashing.
Password Hashing
Vortos uses Argon2id via PHP's built-in password_hash. Argon2id is the current recommended algorithm for password hashing — resistant to GPU cracking and side-channel attacks.
Basic usage
use Vortos\Auth\Contract\PasswordHasherInterface;
final class RegisterUserHandler
{
public function __construct(private PasswordHasherInterface $hasher) {}
public function __invoke(RegisterUserCommand $command): User
{
$hash = $this->hasher->hash($command->password);
$user = User::registerUser($command->email, $hash);
// ...
}
}// Verification (login):
if (!$this->hasher->verify($plaintext, $user->getPasswordHash())) {
return new JsonResponse(['error' => 'Invalid credentials'], 401);
}Automatic rehashing
When you update cost parameters (e.g. increase memory), existing stored hashes need to be upgraded. PHP's password_needs_rehash() detects this:
// After successful login verification:
if ($this->hasher->needsRehash($user->getPasswordHash())) {
$newHash = $this->hasher->hash($plaintext);
$this->userRepository->updatePasswordHash($user->getId(), $newHash);
}Do this transparently on every successful login — users never notice.
Default cost parameters
algorithm: Argon2id
memory_cost: 65536 (64 MB)
time_cost: 4 iterations
threads: 1Tune based on your hardware. Target 100–300ms per hash. Benchmark:
php -r "
\$t = microtime(true);
password_hash('test', PASSWORD_ARGON2ID, ['memory_cost' => 65536, 'time_cost' => 4]);
echo round((microtime(true) - \$t) * 1000) . 'ms';
"Injecting the hasher
// By interface — swappable:
public function __construct(private PasswordHasherInterface $hasher) {}
// By concrete class — explicit:
public function __construct(private ArgonPasswordHasher $hasher) {}