Hi all,
I’d like to gather opinions on the possibility of switching PASSWORD_DEFAULT from bcrypt to Argon2id.
A few reasons to do so:
- bcrypt has a limit of (and silently truncates at) 72 bytes, which may seem like an acceptable thing at first glance, but does cause many headaches
- Argon2 is superior in every way and widely recognized as the gold standard today; I’ve even encountered people who mistakenly believed it is already PHP’s default
- While both algorithms are (by today’s understanding) considered safe from quantum threat, Argon2’s memory hardness makes it future-proof by design
But there is one contentious circumstance - bcrypt is entirely bundled with PHP, while Argon2 has external dependencies: libargon2, libsodium, or (since PHP 8.4) openssl. The addition of OpenSSL is key, because it’s the most ubiquitous and a practical must for almost any environment, IMO making changing PASSWORD_DEFAULT viable. But am I right to think that, or is any external dependency likely to kill the proposal? That’s what I want to gauge before fleshing out an RFC with the greater detail it deserves.
Cheers,
Andrey.
On Fri, Sep 18, 2026, at 22:20, Andrey Andreev wrote:
But there is one contentious circumstance - bcrypt is entirely bundled with PHP, while Argon2 has external dependencies: libargon2, libsodium, or (since PHP 8.4) openssl.
This is both a con and pro. Using a crypto library instead of a roll-your-own solution seems a very wise decision to me. Not to say that I don’t trust the php bcrypt implementation. Just saying this as a general rule.
Greetings, Casper
On 18/09/2026 23:20, Andrey Andreev wrote:
Hi all,
I'd like to gather opinions on the possibility of switching PASSWORD_DEFAULT from bcrypt to Argon2id.
A few reasons to do so:
- bcrypt has a limit of (and silently truncates at) 72 bytes, which may seem like an acceptable thing at first glance, but does cause many headaches
- Argon2 is superior in every way and widely recognized as the gold standard today; I've even encountered people who mistakenly believed it is already PHP's default
- While both algorithms are (by today's understanding) considered safe from quantum threat, Argon2's memory hardness makes it future-proof by design
But there is one contentious circumstance - bcrypt is entirely bundled with PHP, while Argon2 has external dependencies: libargon2, libsodium, or (since PHP 8.4) openssl. The addition of OpenSSL is key, because it's the most ubiquitous and a practical must for almost any environment, IMO making changing PASSWORD_DEFAULT viable. But am I right to think that, or is any external dependency likely to kill the proposal? That's what I want to gauge before fleshing out an RFC with the greater detail it deserves.
Cheers,
Andrey.
Hi Andrey
Did anything change since the last time?
--
Anton
Hi Anton,
On Sat, Sep 19, 2026 at 5:15 AM Anton Smirnov <sandfox@sandfox.me> wrote:
Did anything change since the last time?
https://externals.io/message/120993#120996
Yes, that thread is from September 2023, more than a year before PHP 8.4’s release bringing in the --with-openssl-argon2 flag.
libargon2 and libsodium can’t be relied upon to exist on most systems, but openssl is a very different beast.
There already exists a year-old proposal to enable --with-openssl-argon2 by default (https://github.com/php/php-src/pull/19360). It would be fair to point out that I am thinking ahead of it, this is exploring potential and there are plenty of subsequent problems to debate after. But whether the openssl dependency is acceptable is the most critical one.
Cheers,
Andrey.
On 19/09/2026 12:26, Andrey Andreev wrote:
Hi Anton,
On Sat, Sep 19, 2026 at 5:15 AM Anton Smirnov <sandfox@sandfox.me <mailto:sandfox@sandfox.me>> wrote:
Did anything change since the last time?
PASSWORD_DEFAULT value - Externals <https://externals.io/
message/120993#120996>
Yes, that thread is from September 2023, more than a year before PHP 8.4's release bringing in the --with-openssl-argon2 flag.
libargon2 and libsodium can't be relied upon to exist on most systems, but openssl is a very different beast.
There already exists a year-old proposal to enable --with-openssl-argon2 by default (enable openssl-argon2 by default by henderkes · Pull Request #19360 · php/php-src · GitHub <https:// github.com/php/php-src/pull/19360>). It would be fair to point out that I am thinking ahead of it, this is exploring potential and there are plenty of subsequent problems to debate after. But whether the openssl dependency is acceptable is the most critical one.
Cheers,
Andrey.
My point is mostly about this part:
Argon2 for settings that are reasonable for interactive
authentication is worse than BCrypt
Like, if there were any successful attacks on bcrypt that negate that part