PHPackages                             remi/xpass - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Security](/categories/security)
4. /
5. remi/xpass

ActivePhp-ext[Security](/categories/security)

remi/xpass
==========

Extended password extension

v1.2.0(4mo ago)14152[1 PRs](https://github.com/remicollet/php-xpass/pulls)PHP-3.01CPHP >= 8.0.0CI passing

Since Oct 7Pushed 4mo ago1 watchersCompare

[ Source](https://github.com/remicollet/php-xpass)[ Packagist](https://packagist.org/packages/remi/xpass)[ RSS](/packages/remi-xpass/feed)WikiDiscussions master Synced 1mo ago

READMEChangelogDependenciesVersions (3)Used By (0)

[![CI](https://github.com/remicollet/php-xpass/actions/workflows/ci.yaml/badge.svg)](https://github.com/remicollet/php-xpass/actions/workflows/ci.yaml)

xpass extension for PHP
=======================

[](#xpass-extension-for-php)

This extension provides password hashing algorithms used by Linux distributions.

- **sha512** (`$6$`) provided for legacy as used on some old distributions (ex: RHEL-8)
- **yescrypt** (`$y$`) used on modern distributions
- **sm3crypt** (`$sm3$`)
- **sm3yescrypt** (`$sm3y$`)

Notices: these can be fast, don't expect improved security level.

It also provides additional functions from libxcrypt missing in core PHP:

- `crypt_preferred_method`: get the prefix of the preferred hash method
- `crypt_gensalt`: encode settings for passphrase hashing
- `crypt_checksalt`: validate a crypt setting string

See the Linux man pages or [PHP Documentation](https://www.php.net/xpass)

**Computation time**

- bcrypt: 0.33"
- argon2i: 0.53"
- argon2id: 0.55"
- sha512: 0.01"
- yescrypt: 0.07" with default cost of 5
- yescrypt: 0.14" with cost=6
- yescrypt: 0.30" with cost=7
- yescrypt: 0.62" with cost=8
- sm3crypt: 0.01"
- yessm3crypt: 0.02"

Sources
=======

[](#sources)

- Official git repository:
- Mirror on github for contributors:

Build
=====

[](#build)

Compatible with PHP 8.0 or greater.

It is recommended to ensure PHP is built using `--with-external-libcrypt` option.

You need the Extended crypt library development files (libxcrypt-devel, libcrypt-dev) version 4.4 or greater.

From the sources tree

```
$ phpize
$ ./configure --enable-xpass
$ make
$ make test

```

From  using pecl command

```
$ pecl install xpass

```

From  using PHP Installer for Extensions

```
$ pie install remi/xpass

```

Usage
=====

[](#usage)

password hashing and verifying
------------------------------

[](#password-hashing-and-verifying)

```
$ php -a

php > var_dump($hash = password_hash("secret", PASSWORD_SHA512));
string(106) "$6$y2T3Ql8zEgzbpZeK$s42Q92ggqycC280QMx4.bid1gKI8ghM7ZQJF.F.fbY49Cqj/gnS9h3CiOXyYh0pvtisqiNavSPJP8ZR9Ty7RX1"

php > var_dump($hash = password_hash("secret", PASSWORD_YESCRYPT));
string(73) "$y$j9T$X9Va6i3zHjyKGJAskYZPv.$i1m/WR1C6/tqhB7IdOsi9Ar1JF4Qr38vBx104ao1OS5"

php > var_dump($hash = password_hash("secret", PASSWORD_YESCRYPT, ['cost'=>7]));
string(73) "$y$jBT$bo5CcI5fdsyad1Av.vgLQ.$FgOq74zufVvkOL/q4OBmcKDMMXJB9VzrJXEZrhoVjf6"

php > var_dump(password_verify("secret", $hash));
bool(true)

```

supported options
-----------------

[](#supported-options)

- `cost` controls the CPU time cost of the hash. If `cost` is 0, a reasonable default cost will be selected.

crypt helpers
-------------

[](#crypt-helpers)

```
$ php -a

php > var_dump(crypt_preferred_method());
string(3) "$y$"

php > var_dump($salt = crypt_gensalt());
string(29) "$y$j9T$EitfN8MxRjFzV5tNe97D70"

php > var_dump(crypt_checksalt($salt) == CRYPT_SALT_OK);
bool(true)

php > var_dump($hash = crypt("secret", $salt));
string(73) "$y$j9T$EitfN8MxRjFzV5tNe97D70$vGtxczdGMTLh0LfpwxAmyzgba7EODsmazEh03kpvbh3"

php > var_dump($hash === crypt("secret", $hash));
bool(true)

```

LICENSE
=======

[](#license)

Author: Remi Collet

This extension is licensed under [The PHP License, version 3.01](http://www.php.net/license/3_01.txt)

History
=======

[](#history)

Created on user request for consistency with system crypto.

###  Health Score

39

—

LowBetter than 86% of packages

Maintenance77

Regular maintenance activity

Popularity15

Limited adoption so far

Community13

Small or concentrated contributor base

Maturity45

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 91.2% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~463 days

Total

2

Last Release

126d ago

### Community

Maintainers

![](https://www.gravatar.com/avatar/25f645614863d905f60f28c4b59df3e1b81c3426f5e38f918e3f08c4136a3a1a?d=identicon)[remi](/maintainers/remi)

---

Top Contributors

[![remicollet](https://avatars.githubusercontent.com/u/270445?v=4)](https://github.com/remicollet "remicollet (52 commits)")[![zeriyoshi](https://avatars.githubusercontent.com/u/10289597?v=4)](https://github.com/zeriyoshi "zeriyoshi (3 commits)")[![cmb69](https://avatars.githubusercontent.com/u/2306138?v=4)](https://github.com/cmb69 "cmb69 (1 commits)")[![DanielEScherzer](https://avatars.githubusercontent.com/u/179652704?v=4)](https://github.com/DanielEScherzer "DanielEScherzer (1 commits)")

### Embed Badge

![Health badge](/badges/remi-xpass/health.svg)

```
[![Health](https://phpackages.com/badges/remi-xpass/health.svg)](https://phpackages.com/packages/remi-xpass)
```

###  Alternatives

[defuse/php-encryption

Secure PHP Encryption Library

3.9k162.4M214](/packages/defuse-php-encryption)[mews/purifier

Laravel 5/6/7/8/9/10 HtmlPurifier Package

2.0k16.7M113](/packages/mews-purifier)[robrichards/xmlseclibs

A PHP library for XML Security

41478.1M118](/packages/robrichards-xmlseclibs)[bjeavons/zxcvbn-php

Realistic password strength estimation PHP library based on Zxcvbn JS

87117.5M63](/packages/bjeavons-zxcvbn-php)[illuminate/encryption

The Illuminate Encryption package.

9229.7M280](/packages/illuminate-encryption)[paragonie/hidden-string

Encapsulate strings in an object to hide them from stack traces

7410.6M39](/packages/paragonie-hidden-string)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)