Hashing

Hash::make

Never store plain passwords, since any database leak would expose them all. Make turns a password into a one-way hash that cannot be turned back.

Save only the hash in the users table, with the Hash facade imported at the top.

use Illuminate\Support\Facades\Hash; $hash = Hash::make("secret123");

Hash::check

Login compares the typed password against the stored hash without ever decoding it. Check returns true only when the plain value matches the hash.

Branch on the result and keep timing details to the framework.

if (Hash::check("secret123", $user->password)) { echo "welcome back"; }

Needs rehash

Hash settings improve over time, so old hashes may use weaker options. NeedsRehash flags hashes that deserve a fresh make with current settings.

Check it at login, when the plain password is still at hand.

if (Hash::needsRehash($hash)) { $hash = Hash::make("secret123"); }

Bcrypt default note

Bcrypt is the default driver and a safe pick for most apps. Argon variants exist for servers with tuned memory settings.

Set the driver in the env file and keep make and check calls unchanged.

HASH_DRIVER=bcrypt

Next: Sanctum tokens

Article author: Arthur Isaev