PHPackages                             vanilla/garden-password - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Authentication & Authorization](/categories/authentication)
4. /
5. vanilla/garden-password

ActiveLibrary[Authentication & Authorization](/categories/authentication)

vanilla/garden-password
=======================

Provides a standard password hashing interface and support for password hashing in common frameworks.

v1.3.1(1y ago)0153.2k↓37.1%2[1 issues](https://github.com/vanilla/garden-password/issues)1MITPHPPHP >=7.4.0

Since Apr 17Pushed 1y ago12 watchersCompare

[ Source](https://github.com/vanilla/garden-password)[ Packagist](https://packagist.org/packages/vanilla/garden-password)[ RSS](/packages/vanilla-garden-password/feed)WikiDiscussions master Synced 1mo ago

READMEChangelog (6)Dependencies (1)Versions (15)Used By (1)

Garden Password
===============

[](#garden-password)

[![CI](https://github.com/vanilla/garden-password/actions/workflows/ci.yml/badge.svg)](https://github.com/vanilla/garden-password/actions/workflows/ci.yml)[![Packagist Version](https://camo.githubusercontent.com/2f5ec6329ac0a9d8ea9d6e235400a1ef04a26a597f013ac8c8d922470b736289/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f76616e696c6c612f67617264656e2d70617373776f72642e7376673f7374796c653d666c61742d737175617265)](https://packagist.org/packages/vanilla/garden-password)[![MIT License](https://camo.githubusercontent.com/a7b4645a1621cdf28b09503f63800f2acff84da41e6f62250c902bf649395f09/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f6c2f76616e696c6c612f67617264656e2d70617373776f72642e7376673f7374796c653d666c61742d737175617265)](https://camo.githubusercontent.com/a7b4645a1621cdf28b09503f63800f2acff84da41e6f62250c902bf649395f09/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f6c2f76616e696c6c612f67617264656e2d70617373776f72642e7376673f7374796c653d666c61742d737175617265)

Garden Password implements a common interface for various password hashing algorithms.

Why we made Garden Password
---------------------------

[](#why-we-made-garden-password)

Although the industry seems to be settling on [bcrypt](https://en.wikipedia.org/wiki/Bcrypt) as a standard for secure password hashes there are still a lot of legacy systems out there. When you want to import data from one of these legacy systems you will need some way to bridge the password hashes so that users can sign in without resetting their passwords.

Installation
------------

[](#installation)

*Garden Password requires PHP 5.4 or higher. If you want to use the PhpPassword object prior to PHP 5.5 you can require the [password-compat](https://packagist.org/packages/ircmaxell/password-compat) package.*

Garden Password is [PSR-4](https://github.com/php-fig/fig-standards/blob/master/accepted/PSR-4-autoloader.md) compliant and can be installed using [composer](//getcomposer.org). Just add `vanilla/garden-password` to your composer.json.

```
{
    "require": {
        "vanilla/garden-password": "~1.0"
    }
}
```

The PasswordInterface
---------------------

[](#the-passwordinterface)

The **PasswordInterface** is the basic interface that all of the password algorithms adhere to. You should type hint to this interface and then choose an appropriate implementation for your application. We recommend using **PhpPassword** for new applications. The **PasswordInterface** is a very simple interface with only three methods.

### hash()

[](#hash)

```
public string hash(string $password)
```

Hash a plaintext password. This will return a one-way, salted hash that is appropriate to store in the database. Once you have this hash you should throw the plaintext password away.

### needsRehash()

[](#needsrehash)

```
public string needsRehash(string $hash)
```

Check to see if an existing password hash needs to be re-hashed. A password needs to be re-hashed when the algorithm had a security concern that was later fixed. You usually call this method when a user signs in and you have their plaintext password. First check to see if their password verifies against the existing hash and then check to see if it needs to be updated. If you need to re-hash then hash the plaintext password again and store the new hash in the database. In this way you can gradually improve the security of your system.

### verify()

[](#verify)

```
public bool verify(string $password, string $hash)
```

Verify a password against a stored hash. This is the method you call to check a user's password when they sign in.

Contributing
------------

[](#contributing)

If you want to help build out this library we'd really appreciate it. Here are some great ways you can help:

1. Send pull requests with new hashing algorithms. If you know another system and know how its passwords work then send us an implementation.
2. If you know a password hashing algorithm that you want added, but don't want to make a pull-request that's okay. Create an issue and give us the details of the algorithm and we'll implement the algorithm if we can.
3. Send some example password/hash pairs for existing algorithms. If you are running a system with legacy passwords then you can send us some example passwords with their associated hashes. We can then add these to our unit tests. *Don't send us passwords you actually use! Just make a temporary password and send it along with its hash.*

**Note: We cannot reverse engineer a password hashing algorithm from example passwords and hashes.**

###  Health Score

44

—

FairBetter than 92% of packages

Maintenance38

Infrequent updates — may be unmaintained

Popularity33

Limited adoption so far

Community22

Small or concentrated contributor base

Maturity71

Established project with proven stability

 Bus Factor1

Top contributor holds 51.2% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~449 days

Recently: every ~565 days

Total

8

Last Release

539d ago

PHP version history (2 changes)v1.0.0PHP >=5.4.0

v1.3PHP >=7.4.0

### Community

Maintainers

![](https://www.gravatar.com/avatar/da29e060f227028e8ee38bb5873ba2188fb5236b20b3dffec766c768019d8bd8?d=identicon)[tburry](/maintainers/tburry)

![](https://www.gravatar.com/avatar/ea17fedfd653c4692cf93a4faada50927cef9537dafed0dd4b1517e54fd71728?d=identicon)[charrondev](/maintainers/charrondev)

---

Top Contributors

[![tburry](https://avatars.githubusercontent.com/u/97432?v=4)](https://github.com/tburry "tburry (22 commits)")[![DaazKu](https://avatars.githubusercontent.com/u/2412909?v=4)](https://github.com/DaazKu "DaazKu (8 commits)")[![OlivierLamyCanuel](https://avatars.githubusercontent.com/u/39598345?v=4)](https://github.com/OlivierLamyCanuel "OlivierLamyCanuel (6 commits)")[![JReko](https://avatars.githubusercontent.com/u/15312192?v=4)](https://github.com/JReko "JReko (3 commits)")[![scrutinizer-auto-fixer](https://avatars.githubusercontent.com/u/6253494?v=4)](https://github.com/scrutinizer-auto-fixer "scrutinizer-auto-fixer (2 commits)")[![charrondev](https://avatars.githubusercontent.com/u/1770056?v=4)](https://github.com/charrondev "charrondev (1 commits)")[![Crousem](https://avatars.githubusercontent.com/u/85711978?v=4)](https://github.com/Crousem "Crousem (1 commits)")

---

Tags

productionphppasswordvanillagardenvanilla forums

###  Code Quality

TestsPHPUnit

### Embed Badge

![Health badge](/badges/vanilla-garden-password/health.svg)

```
[![Health](https://phpackages.com/badges/vanilla-garden-password/health.svg)](https://phpackages.com/packages/vanilla-garden-password)
```

###  Alternatives

[ellaisys/aws-cognito

AWS Cognito package that allows Auth and other related features using the AWS SDK for PHP

120220.7k1](/packages/ellaisys-aws-cognito)[martbock/laravel-diceware

Diceware Passphrase Generator for Laravel

3264.7k](/packages/martbock-laravel-diceware)[texxasrulez/persistent_login

This server-side plugin is useful for all Roundcube users who don’t like to log into their e-mail account each time they open their browser. The plugin stores a persistent login cookie which automatically logs the user in the next time he or she visits the Roundcube web mailer.

174.8k](/packages/texxasrulez-persistent-login)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)