> For the complete documentation index, see [llms.txt](https://l-shop-en.gitbook.io/documentation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://l-shop-en.gitbook.io/documentation/software-api/changing-the-password-hashing-algorithm.md).

# Changing the password hashing algorithm

\
If you use the store in conjunction with any plug-ins (or for any other reason), you may need to change the algorithm for hashing user passwords in the database. Fortunately, the system makes it easy to do this.

Hasher is a class that implements the `App\Services\Auth\Hashing\Hasher` interface and contains the hashing and hash validation logic.

The hash class is registered in the `/config/auth.php` file:

{% code title="/config/auth.php" %}

```php
'hasher' => \App\Services\Auth\Hashing\BcryptHasher::class
```

{% endcode %}

List of hashers supplied from the box:

* `App\Services\Auth\Hashing\BcryptHasher`
* `App\Services\Auth\Hashing\WhirlpoolHasher`
* `App\Services\Auth\Hashing\Sha256Hasher`
* `App\Services\Auth\Hashing\Sha512Hasher`
* `App\Services\Auth\Hashing\CallbackHasher`

{% code title="/app/Services/Auth/Hashing/Md5Hasher.php" %}

```php
<?php
declare(strict_types = 1);

namespace App\Services\Auth\Hashing;

class Md5Hasher implements Hasher
{
    /**
     * {@inheritdoc}
     */
    public function make(string $plainPassword): string
    {
        return md5($plainPassword);
    }

    /**
     * {@inheritdoc}
     */
    public function check(string $plainPassword, string $hashedPassword): bool
    {
        return md5($plainPassword) === $hashedPassword;
    }
}
```

{% endcode %}

{% hint style="danger" %}
We do not recommend using the md5 algorithm to store passwords in the database because of its low resilience to brute force and the abundance of rainbow tables. Using the standard bcrypt algorithm (with which the L-Shop is supplied) is the most reasonable solution.
{% endhint %}

Note that after doing the above operations, no one else can log in under existing passwords to the account. You will need to delete all users (manually or with the user:delete command) and ask to register again.