Re: [Discussion] Changing PASSWORD_DEFAULT to Argon2
| From: | Casper Langemeijer | Date: | Fri, 18 Sep 2026 20:37:32 +0000 |
| Subject: | Re: [Discussion] Changing PASSWORD_DEFAULT to Argon2 | ||
| References: | 1 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-132544@lists.php.net to get a copy of this message | ||
On Fri, Sep 18, 2026, at 22:20, Andrey Andreev wrote:
> But there is one contentious circumstance - bcrypt is entirely bundled with PHP, while Argon2
> has external dependencies: libargon2, libsodium, or (since PHP 8.4) openssl.
This is both a con and pro. Using a crypto library instead of a roll-your-own solution seems a very
wise decision to me. Not to say that I don't trust the php bcrypt implementation. Just saying
this as a general rule.
Greetings, Casper