<p>The 3rd parameter for the hash cost you can control via the <a href="https://docs.craftcms.com/api/v3/craft-config-generalconfig.html#property-blowfishhashcost" rel="nofollow noreferrer">blowfishHashCost</a> config setting.</p>

<p>The 2nd parameter (for the algorithm) is a bit more difficult because it's not exposed via a config setting. I assume you want to use PASSWORD_ARGON2I since that and PASSWORD_BCRYPT 
 (the default) are the only two options: <a href="https://secure.php.net/manual/en/function.password-hash.php" rel="nofollow noreferrer">https://secure.php.net/manual/en/function.password-hash.php</a></p>

<p>You'd need to create a custom <a href="https://docs.craftcms.com/v3/configuration.html#application-config" rel="nofollow noreferrer">Application Config</a> component that overrode Craft's <code>security</code> component with your own Security class.  Your own class could extend Craft's an overwrite just the <code>hashPassword</code> method, or any others that you might need to.</p>

CC BY-SA 4.0
2018-06-28T12:21:07.007Z
The 3rd parameter doesn't only consist of the cost, if I want to customize the salt generation, Craft doesn't provide a config for that. So the best way to do this is indeed to rewrite the Security class.
dustfeather
CC BY-SA 4.0
2018-06-21T18:56:44.953Z
2018-06-21T18:56:44.953Z
Brad Bell
<p>Is there a way to specify in Craft 3 which hashing algorithm should passwords use?
I know craft 3 uses PHP's <code>password_hash()</code> function, my question is: is there a way of modifying the 2nd and 3rd parameter of that function via a craft config.</p>

<p>I'm trying to find a way of doing this without using a separate/custom column in the users table.</p>

<p>Thank you.</p>

CC BY-SA 4.0
2018-06-21T18:48:58.810Z
You're looking to use PASSWORD_ARGON2I instead of bcrypt?
Brad Bell
<plugin-development><craft3>
Change Craft 3 password algorithm
# Change Craft 3 password algorithm

(Asked by: username_0 on 2018-06-21)

Is there a way to specify in Craft 3 which hashing algorithm should passwords use?
I know craft 3 uses PHP's `password_hash()` function, my question is: is there a way of modifying the 2nd and 3rd parameter of that function via a craft config.

I'm trying to find a way of doing this without using a separate/custom column in the users table.

Thank you.

**Tags:** plugin-development, craft3
> **Comments:**
> **username_1**: You're looking to use PASSWORD_ARGON2I instead of bcrypt?  

---

## 1 answers

### Answer by username_1 on 2018-06-21. Score: 0 | Accepted answer

The 3rd parameter for the hash cost you can control via the [blowfishHashCost](https://docs.craftcms.com/api/v3/craft-config-generalconfig.html#property-blowfishhashcost) config setting.

The 2nd parameter (for the algorithm) is a bit more difficult because it's not exposed via a config setting. I assume you want to use PASSWORD\_ARGON2I since that and PASSWORD\_BCRYPT
(the default) are the only two options: <https://secure.php.net/manual/en/function.password-hash.php>

You'd need to create a custom [Application Config](https://docs.craftcms.com/v3/configuration.html#application-config) component that overrode Craft's `security` component with your own Security class. Your own class could extend Craft's an overwrite just the `hashPassword` method, or any others that you might need to.

> **Comments:**
> **username_0**: The 3rd parameter doesn't only consist of the cost, if I want to customize the salt generation, Craft doesn't provide a config for that. So the best way to do this is indeed to rewrite the Security class.  

---

