Answers.Body: <p>The 3rd parameter for the hash cost you can control via the <a href="https://docs.craftcms.com/api/v3/craft-config-generalconfig.html#property-blowfishhashcost" rel="nofollow noreferrer">blowfishHashCost</a> config setting.</p>
  
  <p>The 2nd parameter (for the algorithm) is a bit more difficult because it's not exposed via a config setting. I assume you want to use PASSWORD_ARGON2I since that and PASSWORD_BCRYPT 
   (the default) are the only two options: <a href="https://secure.php.net/manual/en/function.password-hash.php" rel="nofollow noreferrer">https://secure.php.net/manual/en/function.password-hash.php</a></p>
  
  <p>You'd need to create a custom <a href="https://docs.craftcms.com/v3/configuration.html#application-config" rel="nofollow noreferrer">Application Config</a> component that overrode Craft's <code>security</code> component with your own Security class.  Your own class could extend Craft's an overwrite just the <code>hashPassword</code> method, or any others that you might need to.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-06-28T12:21:07.007Z
Answers.Text: The 3rd parameter doesn't only consist of the cost, if I want to customize the salt generation, Craft doesn't provide a config for that. So the best way to do this is indeed to rewrite the Security class.
Answers.UserDisplayName: dustfeather
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-06-21T18:56:44.953Z
Answers.LastActivityDate: 2018-06-21T18:56:44.953Z
Answers.UserDisplayName: Brad Bell
Body: <p>Is there a way to specify in Craft 3 which hashing algorithm should passwords use?
  I know craft 3 uses PHP's <code>password_hash()</code> function, my question is: is there a way of modifying the 2nd and 3rd parameter of that function via a craft config.</p>
  
  <p>I'm trying to find a way of doing this without using a separate/custom column in the users table.</p>
  
  <p>Thank you.</p>
  
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2018-06-21T18:48:58.810Z
Comments.Text: You're looking to use PASSWORD_ARGON2I instead of bcrypt?
Comments.UserDisplayName: Brad Bell
Tags: <plugin-development><craft3>
Title: Change Craft 3 password algorithm
ThreadText: # Change Craft 3 password algorithm
  
  (Asked by: username_0 on 2018-06-21)
  
  Is there a way to specify in Craft 3 which hashing algorithm should passwords use?
  I know craft 3 uses PHP's `password_hash()` function, my question is: is there a way of modifying the 2nd and 3rd parameter of that function via a craft config.
  
  I'm trying to find a way of doing this without using a separate/custom column in the users table.
  
  Thank you.
  
  **Tags:** plugin-development, craft3
  
  > **Comments:**
  > **username_1**: You're looking to use PASSWORD_ARGON2I instead of bcrypt?  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2018-06-21. Score: 0 | Accepted answer
  
  The 3rd parameter for the hash cost you can control via the [blowfishHashCost](https://docs.craftcms.com/api/v3/craft-config-generalconfig.html#property-blowfishhashcost) config setting.
  
  The 2nd parameter (for the algorithm) is a bit more difficult because it's not exposed via a config setting. I assume you want to use PASSWORD\_ARGON2I since that and PASSWORD\_BCRYPT
  (the default) are the only two options: <https://secure.php.net/manual/en/function.password-hash.php>
  
  You'd need to create a custom [Application Config](https://docs.craftcms.com/v3/configuration.html#application-config) component that overrode Craft's `security` component with your own Security class. Your own class could extend Craft's an overwrite just the `hashPassword` method, or any others that you might need to.
  
  > **Comments:**
  > **username_0**: The 3rd parameter doesn't only consist of the cost, if I want to customize the salt generation, Craft doesn't provide a config for that. So the best way to do this is indeed to rewrite the Security class.  
  
  ---
  
  