laravel/laravel/security/hasher.php

<?php namespace Laravel\Security; use Laravel\Str;

class Hasher {

	/**
	 * Hash a password using the Bcrypt hashing scheme.
	 *
	 * Bcrypt provides a future-proof hashing algorithm by allowing the
	 * number of "rounds" to be increased, thus increasing the time it
	 * takes to generate the hashed value. The longer it takes takes
	 * to generate the hash, the more impractical a rainbow table
	 * attack against the hashes becomes.
	 *
	 * <code>
	 *		// Create a Bcrypt hash of a value
	 *		$hash = Hasher::hash('secret');
	 *
	 *		// Use a specified number of iterations when creating the hash
	 *		$hash = Hasher::hash('secret', 12);
	 * </code>
	 *
	 * @param  string  $value
	 * @param  int     $rounds
	 * @return string
	 */
	public static function hash($value, $rounds = 8)
	{
		return crypt($value, '$2a$'.str_pad($rounds, 2, '0', STR_PAD_LEFT).'$'.static::salt());
	}

	/**
	 * Determine if an unhashed value matches a given Bcrypt hash.
	 *
	 * @param  string  $value
	 * @param  string  $hash
	 * @return bool
	 */
	public static function check($value, $hash)
	{
		return crypt($value, $hash) === $hash;
	}

	/**
	 * Get a salt for use during Bcrypt hashing.
	 *
	 * Bcrypt expects salts to be 22 alpha-numeric characters including
	 * dots and forward slashes. OpenSSL will be used if available and
	 * the Str::random method will be used if it isn't.
	 *
	 * @return string
	 */
	protected static function salt()
	{
		if (function_exists('openssl_random_pseudo_bytes'))
		{
			return substr(strtr(base64_encode(openssl_random_pseudo_bytes(16)), '+', '.'), 0 , 22);
		}

		return substr(str_replace('+', '.', base64_encode(Str::random(40))), 0, 22);
	}

}