PHPackages migratetoflarum/old-passwords - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Database & ORM](/categories/database) 4. / 5. migratetoflarum/old-passwords ActiveFlarum-extension[Database & ORM](/categories/database) migratetoflarum/old-passwords ============================= Re-hash passwords from an old platform on the fly 1.0.0(4y ago)83.9k3[1 issues](https://github.com/migratetoflarum/old-passwords/issues)1MITPHP Since Jan 24Pushed 4y ago1 watchersCompare [ Source](https://github.com/migratetoflarum/old-passwords)[ Packagist](https://packagist.org/packages/migratetoflarum/old-passwords)[ RSS](/packages/migratetoflarum-old-passwords/feed)WikiDiscussions master Synced 1mo ago READMEChangelog (2)Dependencies (3)Versions (10)Used By (1) Old Passwords extension by MigrateToFlarum ========================================== [](#old-passwords-extension-by-migratetoflarum) [![Build status](https://camo.githubusercontent.com/d16cdd3fdcb4f85daf006d690f830430b7e421c43bd4d6b24ebb03920f4ba2ae/68747470733a2f2f7472617669732d63692e6f72672f6d696772617465746f666c6172756d2f6f6c642d70617373776f7264732e7376673f6272616e63683d6d6173746572)](https://travis-ci.org/migratetoflarum/old-passwords) [![MIT license](https://camo.githubusercontent.com/7013272bd27ece47364536a221edb554cd69683b68a46fc0ee96881174c4214c/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6c6963656e73652d4d49542d626c75652e737667)](https://github.com/migratetoflarum/old-passwords/blob/master/LICENSE.md) [![Latest Stable Version](https://camo.githubusercontent.com/8e67a67e9dc741b715b6de0b559ef3a44a02dd5a6468a633665d302d3d93362d/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f6d696772617465746f666c6172756d2f6f6c642d70617373776f7264732e737667)](https://packagist.org/packages/migratetoflarum/old-passwords) [![Total Downloads](https://camo.githubusercontent.com/dd039836d0f10447f7fdc48ece027ac1b6c773fa8295b4e9c9588bb1b0f139c6/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f64742f6d696772617465746f666c6172756d2f6f6c642d70617373776f7264732e737667)](https://packagist.org/packages/migratetoflarum/old-passwords) [![Donate](https://camo.githubusercontent.com/0d6e4d8b50b5983a58205941b1a581b1305903393b7a39da574e3f60af3c7f5b/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f70617970616c2d646f6e6174652d79656c6c6f772e737667)](https://www.paypal.me/clarkwinkelmann) This extension allows your users to continue to login with their passwords from a previous platform that was using a different hashing algorithm than Flarum. Installation ------------ [](#installation) ``` composer require migratetoflarum/old-passwords ``` Updating -------- [](#updating) ``` composer update migratetoflarum/old-passwords php flarum migrate php flarum cache:clear ``` Documentation ------------- [](#documentation) This extension is meant to be used alongside a migration script. There are no settings accessible from the UI (you still need to keep the extension enabled for it to work !) The migrations add a `migratetoflarum_old_password` column to your `users` table, which can contain old credentials hashed with different algorithms than bcrypt. This column must contain a valid JSON-serialized object as described below or `null` to not provide an old password. Once a user was correctly identified via an old password, the password is re-hashed with bcrypt, stored in Flarum `password` field and the `migratetoflarum_old_password` column is set to `null`. If you somehow manage to have both a bcrypt-hashed `password` and `migratetoflarum_old_password` value in the database for a user, then the user will be able to login with either password. The password used will override the value of `password` and `migratetoflarum_old_password` will be set to `null`. Compatible hashings ------------------- [](#compatible-hashings) Don't hesitate to open an issue or a PR to suggest a new hashing method. More will be added soon. While some of these options might be convenient for testing purposes or other shenanigans, some can put your old password's users at risk in case of a breach. These options are labelled with **/!\\ Insecure**. Just as the whole extension, use these at your own risks ! ### Plain [](#plain) **/!\\ Insecure**: you can directly salt and hash plain text passwords with bcrypt and store them in `password` instead. Example: ``` {"type":"plain","password":"correcthorsebatterystaple"} ``` ### Bcrypt [](#bcrypt) It probably doesn't make sense to store a bcrypt hash here instead of the `password` column, but it is possible. Example (password = `bcrypt(correcthorsebatterystaple)`): ``` {"type":"bcrypt","password":"$2y$10$pUdywYeC2WZxZROQK0SPIu7x58OdO/aLxKnHRlfB8lni0aS6EEWdu"} ``` ### Phpass [](#phpass) Reads portable and bcrypt hashes created with Phpass. In order to use this type you need to install the [`hautelook/phpass`](https://packagist.org/packages/hautelook/phpass) package: ``` composer require hautelook/phpass:^1.1 ``` Example (password = `portablehash(correcthorsebatterystaple)`): ``` {"type":"phpass","password":"$P$Bdjwj4JGIZcMz02HOu69ULVYMPOMK5."} ``` ### MD5 [](#md5) **/!\\ Insecure**: with or without a salt MD5 stays weak. Consider using the `md5-bcrypt` option below. Example (password = `md5(correcthorsebatterystaple)`): ``` {"type":"md5","password":"e9f5bd2bae1c70770ff8c6e6cf2d7b76"} ``` Example with salt before the password (password = `md5(12345678correcthorsebatterystaple)`): ``` {"type":"md5","password":"eefda52fc6b3747b14b563cef9c95062","salt-before":"12345678"} ``` Example with salt after the password (password = `md5(correcthorsebatterystaple12345678)`): ``` {"type":"md5","password":"72d4f016727f69dcfb736fee65b079c8","salt-after":"12345678"} ``` ### MD5-Bcrypt [](#md5-bcrypt) This is the preferred method to import MD5 hashes. You have to run every old MD5 password hash through bcrypt and store the resulting value in Flarum. Example (password = `bcrypt(md5(correcthorsebatterystaple))`): ``` {"type":"md5-bcrypt","password":"$2y$10$WTM5g/fgvJULmERFBpuv1.zqupDwav0/orAot5gWTpZ0xSCkW6tkq"} ``` Example (password = `bcrypt(md5(12345678correcthorsebatterystaple))`): ``` {"type":"md5-bcrypt","password":"$2y$10$WTM5g/fgvJULmERFBpuv1.zqupDwav0/orAot5gWTpZ0xSCkW6tkq","salt-before":"12345678"} ``` You can use salts the same way as described for MD5. MD5-Double ---------- [](#md5-double) **/!\\ Insecure**: consider using the `md5-double-bcrypt` option below. Same as MD5, but the password is hashed a first time before the salt is added. Example (password = `md5(12345678 + md5(correcthorsebatterystaple))`): ``` {"type":"md5-double","password":"75ed2cf45b78dfaa65915d83b73cee9b","salt-before":"12345678"} ``` You can use salts the same way as described for MD5. MD5-Double-Bcrypt ----------------- [](#md5-double-bcrypt) Same as MD5-Double, with an extra bcrypt layer. Example (password = `bcrypt(md5(12345678 + md5(correcthorsebatterystaple)))`): ``` {"type":"md5-double-bcrypt","password":"$2y$10$aws79gtmfZzV8/ikoJSCyuIVLDKlStBRvNDdJqAr1r6k4ZYjZmcC2","salt-before":"12345678"} ``` ### SHA1 [](#sha1) **/!\\ Insecure**: with or without a salt SHA1 stays weak. Consider using the `sha1-bcrypt` option below. Example (password = `sha1(correcthorsebatterystaple)`): ``` {"type":"sha1","password":"bfd3617727eab0e800e62a776c76381defbc4145"} ``` You can use salts the same way as described for MD5. ### SHA1-Bcrypt [](#sha1-bcrypt) This is the preferred method to import SHA1 hashes. You have to run every old SHA1 password hash through bcrypt and store the resulting value in Flarum. Example (password = `bcrypt(sha1(correcthorsebatterystaple))`): ``` {"type":"sha1-bcrypt","password":"$2y$10$b.K9J5Cc7FBJxtuy/hL/vuypT/2vn5jM42M6vpCFIKBfz9n.HAG2a"} ``` You can use salts the same way as described for MD5. ### SHA1-Double [](#sha1-double) **/!\\ Insecure**: consider using the `sha1-double-bcrypt` option below. Same as `md5-double` for sha1. Example (password = `sha1(12345678 + sha1(correcthorsebatterystaple))`): ``` {"type":"sha1-double","password":"7e7247394d9283ce8b0cf6f862eae667668f1489","salt-before":"12345678"} ``` ### SHA1-Double-Bcrypt [](#sha1-double-bcrypt) Same as `md5-double-bcrypt` for sha1. Example (password = `bcrypt(sha1(12345678 + sha1(correcthorsebatterystaple)))`): ``` {"type":"sha1-double-bcrypt","password":"$2y$10$vtO9973AbQKq2vb9c0zH/OZxUNNagPxrZydMpQelU4L07BJG1Z8cm","salt-before":"12345678"} ``` ### KMD5 [](#kmd5) MD5-based hash used by [Unclassified NewsBoard](http://newsboard.unclassified.de/). Example (password = `first16bytes(md5(correcthorsebatterystaple)) + 12 + last16bytes(md5(correcthorsebatterystaple))`): ``` {"type":"kmd5","password":"caecd5d8c1e3fd9212c2c1cb348fedaed1"} ``` A MigrateToFlarum extension --------------------------- [](#a-migratetoflarum-extension) This is a free extension by MigrateToFlarum, an online forum migration tool (launching soon). Follow us on Twitter for updates Need a custom Flarum extension ? [Contact Clark Winkelmann !](https://clarkwinkelmann.com/flarum) Links ----- [](#links) - [Flarum Discuss post](https://discuss.flarum.org/d/8631) - [Source code on GitHub](https://github.com/migratetoflarum/old-passwords) - [Report an issue](https://github.com/migratetoflarum/old-passwords/issues) - [Download via Packagist](https://packagist.org/packages/migratetoflarum/old-passwords) ### Health Score 35 — LowBetter than 80% of packages Maintenance18 Infrequent updates — may be unmaintained Popularity26 Limited adoption so far Community15 Small or concentrated contributor base Maturity69 Established project with proven stability Bus Factor1 Top contributor holds 84.2% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~152 days Recently: every ~97 days Total 9 Last Release 1810d ago Major Versions 0.6.0 → 1.0.02021-05-28 ### Community Maintainers ![](https://www.gravatar.com/avatar/0538135c1debcef5602dce7ece027909cc832b7a6284ab9189a19aa8de98d60d?d=identicon)[clarkwinkelmann](/maintainers/clarkwinkelmann) --- Top Contributors [![clarkwinkelmann](https://avatars.githubusercontent.com/u/5264300?v=4)](https://github.com/clarkwinkelmann "clarkwinkelmann (16 commits)")[![dsevillamartin](https://avatars.githubusercontent.com/u/6401250?v=4)](https://github.com/dsevillamartin "dsevillamartin (2 commits)")[![AmauryCarrade](https://avatars.githubusercontent.com/u/1417570?v=4)](https://github.com/AmauryCarrade "AmauryCarrade (1 commits)") --- Tags migrationextensionflarumpasswords ### Code Quality TestsPHPUnit ### Embed Badge ![Health badge](/badges/migratetoflarum-old-passwords/health.svg) ``` [![Health](https://phpackages.com/badges/migratetoflarum-old-passwords/health.svg)](https://phpackages.com/packages/migratetoflarum-old-passwords) ``` ### Alternatives [c006/yii2-migration-utility Automatically writes the create tables for migrations or create tables in general 63160.6k1](/packages/c006-yii2-migration-utility)[dmstr/yii2-migrate-command Console Migration Command with multiple paths/aliases support 31295.5k6](/packages/dmstr-yii2-migrate-command)[hzhihua/yii2-dump Generate the schema from an existing database 1828.5k1](/packages/hzhihua-yii2-dump)[flarum-lang/french French language pack to localize the Flarum forum software plus its official and third-party extensions. 2033.8k](/packages/flarum-lang-french)[flarum/gdpr Features for GDPR, PII management 1425.2k15](/packages/flarum-gdpr) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)