Password final class
Minn\Auth\Password · public/minn/src/Minn/Auth/Password.php · 71 lines
The stored password scheme. A modern "$wp$2y$..." value is bcrypt over base64(HMAC-sha384(password, "wp-sha384")) at PHP's default cost (10 up to PHP 8.3, 12 from 8.4) unless the site's options say otherwise; under another algorithm (argon2id) the hash is that algorithm's own. Legacy phpass "$P$" hashes and any other password_hash() value still verify, and a sign-in replaces whatever needsRehash() says is outdated (probe password-rehash).
Public
| static | verify(string $password, string $hash): bool# | Whether a password matches a stored hash: the "$wp$" scheme, legacy phpass, or any hash password_hash() makes. A password over 4,096 characters never matches and costs no hashing. | |||
| static | hash(string $password, string $algorithm = Minn\Auth\PASSWORD_BCRYPT, array $options = array ( )): string# | A stored hash: bcrypt in the "$wp$" scheme over the pre-hash, or, under any other algorithm, that algorithm's own hash of the password.
| |||
| static | needsRehash(string $hash, string $algorithm = Minn\Auth\PASSWORD_BCRYPT, array $options = array ( )): bool# | Whether a stored hash is not the one these settings would make: under bcrypt, anything outside the "$wp$" scheme or at another cost; under another algorithm, whatever PHP says is outdated for it.
| |||
| static | fragment(string $hash): string# | The four characters of the hash the cookie key is derived from: offset 8 for legacy phpass ("$P$") and plain bcrypt ("$2y$"), the LAST four for anything else ("$wp$", argon2, whose offset 8 is the same for every password). Getting this wrong yields a cookie that verifies nowhere while every other check passes, so the branches are pinned by the auth suite and the 2026-10-13 audit's probe. |
Internals 1
Private and protected methods: how the class does its work. Not a contract; they change whenever the code is tidied.
| private | prehash(string $password): string# |
Nothing matches.