How does Laravel hash passwords with the Hash Facade?

Short answer

By default, it uses bcrypt (or Argon2), adds a Salt, and creates secure, slow hashes with Hash::make(); verify them with Hash::check().

Explanation

The Hash Facade uses strong algorithms that are intentionally slow. Check a submitted password against its stored hash without decrypting it with Hash::check($plain, $hashed). Hash::needsRehash() also checks whether a hash is outdated and needs its work factor upgraded at login.

Code example

$hashed = Hash::make($password);
if (Hash::check($inputPassword, $user->password)) {
    // Password is correct
}

Common mistakes

• Using simple hash functions such as md5 or sha1 to store passwords.

Follow-up questions

• What is the role of APP_KEY in Laravel, and what are the risks of changing or exposing it in production?

Sources

• Laravel docs — Hashing