Hash user password without User instance in symfony

Question

As it can be read in the official documentation, the current procedure to manually hash a password in the Symfony framework, is the following:

use Symfony\Component\Security\Core\Encoder\UserPasswordEncoderInterface;

public function register(UserPasswordEncoderInterface $encoder)
{
    // whatever *your* User object is
    $user = new App\Entity\User();
    $plainPassword = 'ryanpass';
    $encoded = $encoder->encodePassword($user, $plainPassword);

    $user->setPassword($encoded);
}

The encodePassword method requires an User instance to be passed as its first argument. The User instance must therefore pre-exist when the method is called: this means that a 'User' must be instantiated without a valid hashed password. I'd like the password to be provided as a constructor argument instead, so that an User entity is in a valid state when it is created.

Is there an alternative way of hashing the password using Symfony?

Cerad · Accepted Answer · 2022-07-05 20:42:08Z

6

Update for Symfony 5 and later. The Encoder stuff was renamed to Hasher. The answer still works but just replace EncoderFactoryInterface with PasswordHasherFactoryInterface and change your variable names to hasher.

The UserPasswordEncoder uses what is known as an EncoderFactory to determine the exact password encoder for a given type of user. Adjust your code to:

public function register(EncoderFactoryInterface $encoderFactory)
{
    $passwordEncoder = $encoderFactory->getEncoder(User::class);
    $hashedPassword = $passwordEncoder->encodePassword($plainPassword,null);

And that should work as desired. Notice that getEncoder can take either a class instance or a class name.

Also note the need to explicitly send null for the salt. For some reason, some of the Symfony encoder classes do not have default values for salt yet.

edited Jul 5, 2022 at 20:42

answered Jul 19, 2020 at 14:02

Cerad

49k9 gold badges92 silver badges94 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Egidio Docile Over a year ago

Thank you, It worked as expected. I think this should be included in the documentation. If it is already, could you please point me to it?

Cerad Over a year ago

Start here: symfony.com/doc/current/components/security/… But quite a few of these sorts of details are best figured out by looking at the code itself.

David Petrásek Oct 19 at 10:07

It might work, but it's not the official way. This is the official way: stackoverflow.com/a/79794145/10977967

David Petrásek · Accepted Answer · 2025-10-19 10:01:46Z

0

This is the way for Symfony 5, 6 and 7:

use Symfony\Component\PasswordHasher\Hasher\PasswordHasherFactory;

function hashPassword($plainText)
{
    $factory = new PasswordHasherFactory(
    [
        'common' => ['algorithm' => 'bcrypt']
    ]);
    $hasher = $factory->getPasswordHasher('common');
    return $hasher->hash($plainText);
}

Full example: https://symfony.com/doc/current/security/passwords.html#hashing-a-stand-alone-string

edited Oct 19 at 10:01

answered Oct 19 at 7:34

David Petrásek

351 silver badge7 bronze badges

Collectives™ on Stack Overflow

Hash user password without User instance in symfony

2 Answers 2

3 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

3 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related