Add Argon2 password hashing support in prebuilt binaries

[hoang19020302]

Hi 👋

Thanks for your amazing work on FrankenPHP — it's blazing fast and works beautifully with Laravel Octane.

I noticed that the prebuilt binaries (e.g. frankenphp-linux-x86_64) do not include support for the argon2 password hashing algorithm (e.g. PASSWORD_ARGON2ID).

This causes runtime errors in modern PHP applications (like Laravel or Symfony) that rely on Hash::make() or password_hash() with argon2.

Would you consider enabling --with-password-argon2 when building the password extension in future prebuilt releases?

Thanks again for your awesome work!

[henderkes]

Correct me if I'm wrong, but from my understanding these constants are only defined in the libargon2 backend, which conflicts with the libsodium backend required for other extensions. Php should still support the argonid (not argoni) password hash, just without the threads option and with the constants not defined.

Or you use https://www.php.net/manual/en/function.sodium-crypto-pwhash-str.php

[henderkes]

(And could you let me know which symfony package conflicts? I haven't run into issues and also use the prebuilt binary on my dev system.)

[hoang19020302]

Hi, thanks for the clarification!

You're right that PHP can technically support Argon2id via the libsodium backend using sodium_crypto_pwhash_str(), even without libargon2. However, Laravel (and Symfony too, I believe) expects the PASSWORD_ARGON2ID constant to be defined when using the built-in password_hash() function. Without it, Laravel's Hash::make() (which defaults to argon2id) throws the following error at runtime:

Argon2 hashing not supported.

So even if libsodium is available, Laravel can't fall back to sodium_crypto_pwhash_str() unless a custom hasher is written manually — which breaks compatibility with its default hashing config.

As for Symfony, I haven’t pinpointed a specific conflicting package yet — my focus was on Laravel Octane — but if you’re interested I can dig deeper and report back.

Thanks again for your help and great work on FrankenPHP!

Note: I'm not actually using Symfony directly, just Laravel — so I can't comment on any Symfony package conflicts myself.

[henderkes]

Hmm, I'm not sure we can enable the argon2 backend while keeping the sodium one, for the static binary. I'll try to figure out if there is a way, but if not, the obvious choice to keep is sodium in my opinion.

[hoang19020302]

I can still use agon2id for hashing while still using sodium but need to rewrite the Hashing Class for it to be able to use the sodium driver

<?php

namespace App\Hashing;

use Illuminate\Contracts\Hashing\Hasher as HasherContract;

class SodiumHasher implements HasherContract
{
    public function make($value, array $options = []){}

    public function check($value, $hashedValue, array $options = []){}

    public function needsRehash($hashedValue, array $options = []){}

    public function info($hashedValue){}
}

Thanks again for your help and great work on FrankenPHP!

[henderkes]

I think you misunderstand:

[m@M-TH build]$ curl https://frankenphp.dev/install.sh | sh
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  2198  100  2198    0     0   3980      0 --:--:-- --:--:-- --:--:--  3981
📦 Downloading FrankenPHP for Linux (glibc) (x86_64):
######################################################################## 100.0%

🥳 FrankenPHP downloaded successfully to /home/m/build/frankenphp
🔧 Move the binary to /usr/local/bin/ or another directory in your PATH to use it globally:
   sudo mv /home/m/build/frankenphp /usr/local/bin/

⭐ If you like FrankenPHP, please give it a star on GitHub: https://github.com/dunglas/frankenphp
[m@M-TH build]$ cat argon.php 
#!/usr/bin/env php
<?php

// Test if Argon2id is supported and functioning

$testPassword = 'test123';
$hash = password_hash($testPassword, PASSWORD_ARGON2ID);

if (!password_verify($testPassword, $hash)) {
    fwrite(STDERR, "Argon2id verification failed.\n");
    exit(1);
}

echo "Argon2id is working.\n";
exit(0);
[m@M-TH build]$ ./frankenphp php-cli argon.php 
Argon2id is working.

You can use the argon2 things automatically, just the last threads parameter is limited to only the libargon2 backend.

[henderkes]

Meaning you cannot use

password_hash($testPassword, PASSWORD_ARGON2ID, ['threads' => $i]);

Where $i != 1.

[hoang19020302]

Hi, thank you for the clarification!

You're right — the issue was on my side.

I'm using Laravel 11, and by default, it doesn't generate a config/hashing.php file. So when I use argon2id as the hashing driver without customizing the config, Laravel falls back to default settings that include the threads option (which is only compatible with the libargon2 backend).

Since FrankenPHP uses libsodium instead of libargon2, that threads parameter causes a failure.

Now that I understand this, I’ve added a hashing.php config file and removed the threads option when using argon2id. Everything works perfectly now with FrankenPHP.

Thanks again for the clarification!

[henderkes]

If laravel uses multiple threads by default, that sounds like a bad decision. I don't really work with it, but I'll investigate and propose setting it to the default value as to not require a libargon2 backend.

[henderkes]

https://github.com/search?q=repo%3Ailluminate%2Fhashing%20threads&type=code

Seems correct to me. The constructor and make method call the threads method, which will return 1 if the sodium backend is used. Not sure how you ran into trouble.

[hoang19020302]

You're absolutely right. After revisiting the code, I realized the constructor and make() method do properly call the threads() method, and it correctly returns 1 when the Sodium backend is used.

My confusion came from misinterpreting how the default thread count was being set. Initially, I thought the threads() value wasn't being respected when using Sodium, but that was due to a misread on my part. Once I traced the flow again — especially through Argon2IdHasher and how it handles the threads() fallback — it made sense.

Thanks for the clarification, and apologies for the noise!

Thanks again for your help and great work on FrankenPHP, I really like it.