PHPackages                             componenta/password - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Authentication & Authorization](/categories/authentication)
4. /
5. componenta/password

ActiveLibrary[Authentication & Authorization](/categories/authentication)

componenta/password
===================

Password hashing contract and default implementation

v1.0.0(1mo ago)081MITPHPPHP ^8.4

Since Jun 17Pushed 1mo agoCompare

[ Source](https://github.com/componenta/password)[ Packagist](https://packagist.org/packages/componenta/password)[ RSS](/packages/componenta-password/feed)WikiDiscussions main Synced 1w ago

READMEChangelog (1)Dependencies (2)Versions (2)Used By (1)

Componenta Password
===================

[](#componenta-password)

Password hashing and password verification contracts backed by PHP's native password API.

Use this package when application code should depend on small password abstractions instead of calling `password_hash()` and `password_verify()` directly.

Installation
------------

[](#installation)

```
composer require componenta/password
```

Usage
-----

[](#usage)

```
use Componenta\Stdlib\PasswordHasher;

$hasher = new PasswordHasher(options: ['cost' => 12]);

$hash = $hasher->hash('secret');

$hasher->verify('secret', $hash); // true
$hasher->needsRehash($hash);      // false when algorithm/options still match
```

`PasswordHasher` exposes its configuration as read-only public state:

```
$hasher->algorithm; // PASSWORD_BCRYPT by default
$hasher->options;   // options passed to password_hash()

$argon = $hasher->withAlgorithm(PASSWORD_ARGON2ID);
$stronger = $hasher->withOptions(['cost' => 13]);
```

`withAlgorithm()` and `withOptions()` return new immutable instances.

Contracts
---------

[](#contracts)

`PasswordHasherInterface` is intentionally limited to creating hashes:

```
interface PasswordHasherInterface
{
    public function hash(string $password): string;
}
```

`PasswordVerifierInterface` is intentionally limited to checking hashes:

```
interface PasswordVerifierInterface
{
    public function verify(string $password, string $hash): bool;
}
```

Depend on only the operation a service actually needs. A password reset handler usually needs `PasswordHasherInterface`; an identity confirmation policy usually needs `PasswordVerifierInterface`.

The default `PasswordHasher` implements both interfaces and additionally exposes `needsRehash(string $hash): bool` so applications can migrate stored hashes when algorithm options change.

Configuration
-------------

[](#configuration)

The constructor accepts:

- `algorithm`: passed to PHP's password API.
- `options`: passed to `password_hash()` and `password_needs_rehash()`.

Keep policy decisions such as minimum password length and breach checks in validation/application code. This package only hashes and verifies already accepted password strings.

Related Packages
----------------

[](#related-packages)

PackageWhy it matters here`componenta/auth`Uses the password contracts in password-login and reset flows.`componenta/validation`Validates password length and complexity before hashing.`componenta/di`Can bind `PasswordHasherInterface` and `PasswordVerifierInterface` in the application container.

###  Health Score

41

—

FairBetter than 87% of packages

Maintenance91

Actively maintained with recent releases

Popularity7

Limited adoption so far

Community8

Small or concentrated contributor base

Maturity51

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Unknown

Total

1

Last Release

43d ago

### Community

Maintainers

![](https://avatars.githubusercontent.com/u/20490712?v=4)[Andrey Shelamkoff](/maintainers/Shelamkoff)[@Shelamkoff](https://github.com/Shelamkoff)

---

Top Contributors

[![Shelamkoff](https://avatars.githubusercontent.com/u/20490712?v=4)](https://github.com/Shelamkoff "Shelamkoff (1 commits)")

###  Code Quality

TestsPest

### Embed Badge

![Health badge](/badges/componenta-password/health.svg)

```
[![Health](https://phpackages.com/badges/componenta-password/health.svg)](https://phpackages.com/packages/componenta-password)
```

###  Alternatives

[vitalybaev/laravel5-dkim

Laravel 5/6 package for signing outgoing messages with DKIM.

3163.1k](/packages/vitalybaev-laravel5-dkim)[firemultimedia/mautic-multi-captcha-bundle

This plugin brings Google's reCAPTCHA, hCaptcha, and Cloudflare Turnstile integration to mautic.

141.3k](/packages/firemultimedia-mautic-multi-captcha-bundle)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)