Hashing Passwords with bcrypt or argon2
Laravel never stores passwords in plain text. Instead, it hashes them using strong, purpose-built algorithms designed to resist brute-force and rainbow-table attacks.
Hashing on Registration
$user->password = Hash::make($request->password);Hash::make() applies the configured hashing driver — bcrypt by default — turning the plain password into a long, irreversible hash.
bcrypt vs argon2
| Algorithm | Notes |
|---|---|
| bcrypt | Laravel's default; well-tested, widely supported |
| argon2i / argon2id | Newer, memory-hard algorithm, configurable memory and thread cost |
The driver is set in config/hashing.php and can be switched without changing how the rest of the application calls Hash::make().
Verifying a Password
if (Hash::check($request->password, $user->password)) {
// password matches
}Hashing protects stored credentials, but an application also needs to guard the data flowing in and out of every request — which brings up XSS and SQL injection.
Ready to master Laravel Training Course?
Join Uncodemy's hands-on Laravel program and build real, production-ready applications.