Hash:make returns different result everytime?

user_1759901 0
Viewed 423
>>> Hash::make('password')
=> "$2y$10$Vp7RA3EoThTrlu5JecW1kOkTZQOjVDCtbM.9LysfrZhVz.Jf.53Y."
>>> Hash::make('password')
=> "$2y$10$OlX/8PgvSNN6drM4jVa6XeKQ/q5FKCi8zhMi/Dt7vrz6JPHU/EK4C"
>>> Hash::make('password')
=> "$2y$10$svoJrNRmlEX2XWGU4G4MzekDOvJLJW9uSC2SY98bXad2cSqge.MGK"

Can someone help me understand why Hash::make is giving a different hash on every execution ?

Is there a time based or random component involved.

my config/hashing.php has default values.

    'driver' => 'bcrypt',
    'bcrypt' => [
        'rounds' => env('BCRYPT_ROUNDS', 10),
    ],

    'argon' => [
        'memory' => 1024,
        'threads' => 2,
        'time' => 2,
    ],
laravel-8 php
3 Answers

Your Hash::make() function is using bcrypt hashing algorithm, as the config defines.

Bcrypt produces different outputs for the same input by design. It's not a bug, it's a feature. :-)

To verify a plaintext input (e.g. input password from a login form) against a previously produced hash (e.g. what you stored during registration), use Hash::check().

user_16931920

Hash:make adds what is called "salt" to the hash, it is used to get different results on every call to improve on security.

In your case you are using bcrypt, you can recognize it by the $2y$ at the start of the encrypted string, it is followed by complexity (10) and the salt.

If you want to have a deeper look on how it works, wikipedia has a great article: https://en.wikipedia.org/wiki/Bcrypt

user_129837860

You are correct, and that is the design. you will need to use the below to verify your hash:

Hash::check()

here is a discussion on the topic with more details

Laravel 4.1 Hash::make inconsistency

user_142568760
Related