Hashing Passwords with bcrypt or argon2

Laravel never stores passwords in plain text. Instead, it hashes them using strong, purpose-built algorithms designed to resist brute-force and rainbow-table attacks.

Hashing on Registration

$user->password = Hash::make($request->password);

Hash::make() applies the configured hashing driver — bcrypt by default — turning the plain password into a long, irreversible hash.

bcrypt vs argon2

The driver is set in config/hashing.php and can be switched without changing how the rest of the application calls Hash::make().

Verifying a Password

if (Hash::check($request->password, $user->password)) {
    // password matches
}

Hashing protects stored credentials, but an application also needs to guard the data flowing in and out of every request — which brings up XSS and SQL injection.