PHP developers sometimes need to verify a plaintext password against a sodium Argon2 hash. This comes up when preparing data, displaying results, or integrating information with other services.
The sodium_crypto_pwhash_str_verify() operation handles this particular task. The following examples show its result, its limitations, and a practical way to apply it.
What Is sodium_crypto_pwhash_str_verify() in PHP?
Verify a plaintext password against a sodium Argon2 hash.
Its syntax is:
sodium_crypto_pwhash_str_verify(string $hash, string $password): bool
The syntax shows the expected parameters and return type. Arguments marked with an ampersand are passed by reference and may be modified. Optional parameters control additional behavior; values must match the declared types.
Important: Never compare stored hashes or passwords with ==, and never store plaintext passwords. Separate authentication from authorization.
Parameters:
$hash— A named input or configuration argument; use the declared type and optional default shown above.$password— A named input or configuration argument; use the declared type and optional default shown above.
Example 1: Basic Usage
This first example uses a small input to demonstrate the main result of sodium_crypto_pwhash_str_verify().
<?php
$hash = sodium_crypto_pwhash_str("secret", SODIUM_CRYPTO_PWHASH_OPSLIMIT_INTERACTIVE, SODIUM_CRYPTO_PWHASH_MEMLIMIT_INTERACTIVE); var_dump(sodium_crypto_pwhash_str_verify($hash, "secret"));
Output: The result depends on an installed extension, an existing file, database records, or a randomly selected order. The code is an illustrative example and requires the environment described below.
The output demonstrates the primary operation: verify a plaintext password against a sodium Argon2 hash.
Example 2: Understanding Another Case
This second example changes the input or option to reveal a different behavior of sodium_crypto_pwhash_str_verify().
<?php
$hash = sodium_crypto_pwhash_str("correct", SODIUM_CRYPTO_PWHASH_OPSLIMIT_INTERACTIVE, SODIUM_CRYPTO_PWHASH_MEMLIMIT_INTERACTIVE); var_dump(sodium_crypto_pwhash_str_verify($hash, "wrong"));
Output: The result depends on an installed extension, an existing file, database records, or a randomly selected order. The code is an illustrative example and requires the environment described below.
Compared with the first example, this one illustrates the same operation with a different input shape or option. Never compare stored hashes or passwords with ==, and never store plaintext passwords. Separate authentication from authorization.
Practical Example: A Real Application Scenario
Here is a practical use of sodium_crypto_pwhash_str_verify() with realistic sample information. Adapt the values to match your application.
<?php
$password = "sample-secret"; $storedHash = sodium_crypto_pwhash_str($password, SODIUM_CRYPTO_PWHASH_OPSLIMIT_INTERACTIVE, SODIUM_CRYPTO_PWHASH_MEMLIMIT_INTERACTIVE); echo sodium_crypto_pwhash_str_verify($storedHash, $password) ? "Access granted" : "Access denied";
Output: The result depends on an installed extension, an existing file, database records, or a randomly selected order. The code is an illustrative example and requires the environment described below.
This is a useful starting point, but production code should check errors and validate values before performing the operation. Never compare stored hashes or passwords with ==, and never store plaintext passwords. Separate authentication from authorization.
Important Behavior and Edge Cases
Never compare stored hashes or passwords with ==, and never store plaintext passwords. Separate authentication from authorization.
- Input: Use the expected PHP types and validate user-provided values.
- Result: Check the return value separately from any modifications to the input.
- Environment: For extension, database, or filesystem examples, verify availability and handle failures before accessing results.
Comparison With Related Functions
| Function or Approach | When to Use It |
|---|---|
sodium_crypto_pwhash_str_verify() | Verify a plaintext password against a sodium Argon2 hash. |
| Related functions | password_verify() is for hashes supported by the password_hash API. |
Common Beginner Mistakes
| Mistake | Correct Approach |
|---|---|
| Storing plaintext passwords | Store only password hashes with suitable work factors; never log raw passwords. |
| Using incompatible hash formats | password_verify() is for hashes supported by the password_hash API. |
| Confusing password verification with rehashing | Never compare stored hashes or passwords with ==, and never store plaintext passwords. Separate authentication from authorization. |
Key Takeaways
sodium_crypto_pwhash_str_verify()lets you verify a plaintext password against a sodium Argon2 hash.- Never compare stored hashes or passwords with ==, and never store plaintext passwords. Separate authentication from authorization.
- password_verify() is for hashes supported by the password_hash API.
- Check input, return values, and environmental requirements when adapting the examples.
sodium_crypto_pwhash_str_verify() provides a focused PHP operation for verify a plaintext password against a sodium Argon2 hash. Start with the simple examples, then adapt the practical example with the correct checks for your project.