PHP developers sometimes need to verify a password against a legacy scrypt-formatted hash. This comes up when preparing data, displaying results, or integrating information with other services.
The sodium_crypto_pwhash_scryptsalsa208sha256_str_verify() operation handles this particular task. The following examples show its result, its limitations, and a practical way to apply it.
What Is sodium_crypto_pwhash_scryptsalsa208sha256_str_verify() in PHP?
Verify a password against a legacy scrypt-formatted hash.
Its syntax is:
sodium_crypto_pwhash_scryptsalsa208sha256_str_verify(string $hash, string $password): bool
The syntax shows the expected parameters and return type. Arguments marked with an ampersand are passed by reference and may be modified. Optional parameters control additional behavior; values must match the declared types.
Important: Legacy scrypt verifier is for hashes created with this specific scheme; use contemporary Argon2id/password_hash for new applications and avoid logging passwords.
Parameters:
$hash— A named input or configuration argument; use the declared type and optional default shown above.$password— A named input or configuration argument; use the declared type and optional default shown above.
Example 1: Basic Usage
This first example uses a small input to demonstrate the main result of sodium_crypto_pwhash_scryptsalsa208sha256_str_verify().
<?php
$hash = sodium_crypto_pwhash_scryptsalsa208sha256_str("secret-pass", SODIUM_CRYPTO_PWHASH_SCRYPTSALSA208SHA256_OPSLIMIT_INTERACTIVE, SODIUM_CRYPTO_PWHASH_SCRYPTSALSA208SHA256_MEMLIMIT_INTERACTIVE); var_dump(sodium_crypto_pwhash_scryptsalsa208sha256_str_verify($hash, "secret-pass"));
Output: The result depends on an installed extension, an existing file, database records, or a randomly selected order. The code is an illustrative example and requires the environment described below.
The output demonstrates the primary operation: verify a password against a legacy scrypt-formatted hash.
Example 2: Understanding Another Case
This second example changes the input or option to reveal a different behavior of sodium_crypto_pwhash_scryptsalsa208sha256_str_verify().
<?php
$hash = sodium_crypto_pwhash_scryptsalsa208sha256_str("correct", SODIUM_CRYPTO_PWHASH_SCRYPTSALSA208SHA256_OPSLIMIT_INTERACTIVE, SODIUM_CRYPTO_PWHASH_SCRYPTSALSA208SHA256_MEMLIMIT_INTERACTIVE); var_dump(sodium_crypto_pwhash_scryptsalsa208sha256_str_verify($hash, "wrong"));
Output: The result depends on an installed extension, an existing file, database records, or a randomly selected order. The code is an illustrative example and requires the environment described below.
Compared with the first example, this one illustrates the same operation with a different input shape or option. Legacy scrypt verifier is for hashes created with this specific scheme; use contemporary Argon2id/password_hash for new applications and avoid logging passwords.
Practical Example: A Real Application Scenario
Here is a practical use of sodium_crypto_pwhash_scryptsalsa208sha256_str_verify() with realistic sample information. Adapt the values to match your application.
<?php
$password = "sample-pass"; $hash = sodium_crypto_pwhash_scryptsalsa208sha256_str($password, SODIUM_CRYPTO_PWHASH_SCRYPTSALSA208SHA256_OPSLIMIT_INTERACTIVE, SODIUM_CRYPTO_PWHASH_SCRYPTSALSA208SHA256_MEMLIMIT_INTERACTIVE); echo sodium_crypto_pwhash_scryptsalsa208sha256_str_verify($hash, $password) ? "Verified" : "Denied";
Output: The result depends on an installed extension, an existing file, database records, or a randomly selected order. The code is an illustrative example and requires the environment described below.
This is a useful starting point, but production code should check errors and validate values before performing the operation. Legacy scrypt verifier is for hashes created with this specific scheme; use contemporary Argon2id/password_hash for new applications and avoid logging passwords.
Important Behavior and Edge Cases
Legacy scrypt verifier is for hashes created with this specific scheme; use contemporary Argon2id/password_hash for new applications and avoid logging passwords.
- Input: Use the expected PHP types and validate user-provided values.
- Result: Check the return value separately from any modifications to the input.
- Environment: For extension, database, or filesystem examples, verify availability and handle failures before accessing results.
Comparison With Related Functions
| Function or Approach | When to Use It |
|---|---|
sodium_crypto_pwhash_scryptsalsa208sha256_str_verify() | Verify a password against a legacy scrypt-formatted hash. |
| Related functions | sodium_crypto_pwhash_str_verify() checks sodium Argon2 hashes, not legacy scrypt hashes. |
Common Beginner Mistakes
| Mistake | Correct Approach |
|---|---|
| Storing plaintext passwords | Store only password hashes with suitable work factors; never log raw passwords. |
| Using incompatible hash formats | sodium_crypto_pwhash_str_verify() checks sodium Argon2 hashes, not legacy scrypt hashes. |
| Confusing password verification with rehashing | Legacy scrypt verifier is for hashes created with this specific scheme; use contemporary Argon2id/password_hash for new applications and avoid logging passwords. |
Key Takeaways
sodium_crypto_pwhash_scryptsalsa208sha256_str_verify()lets you verify a password against a legacy scrypt-formatted hash.- Legacy scrypt verifier is for hashes created with this specific scheme; use contemporary Argon2id/password_hash for new applications and avoid logging passwords.
- sodium_crypto_pwhash_str_verify() checks sodium Argon2 hashes, not legacy scrypt hashes.
- Check input, return values, and environmental requirements when adapting the examples.
sodium_crypto_pwhash_scryptsalsa208sha256_str_verify() provides a focused PHP operation for verify a password against a legacy scrypt-formatted hash. Start with the simple examples, then adapt the practical example with the correct checks for your project.