Download the PHP package typisttech/wp-password-argon-two without Composer

On this page you can find all versions of the php package typisttech/wp-password-argon-two. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

  • Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
  • To use Composer is sometimes complicated. Especially for beginners.
  • Composer needs much resources. Sometimes they are not available on a simple webspace.
  • If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
  • Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?

Example code of typisttech/wp-password-argon-two

Informations about the package wp-password-argon-two

[!CAUTION] WP Password Argon Two has been abandoned.

If you want to maintain a fork of WP Password Argon Two, read this blog post (Wayback Machine snaptshot). Otherwise, use roots/wp-password-bcrypt.

WP Password Argon Two

Latest Stable Version Total Downloads Build Status StyleCI License Donate via PayPal Hire Typist Tech

Securely store WordPress user passwords in database with Argon2i hashing and SHA-512 HMAC using PHP's native functions.

Goal

Replace WordPress' phpass hasher with Argon2i hashing and SHA-512 HMAC.

Adopted from Mozilla secure coding guidelines:

The purpose of HMAC and Argon2i storage is as follows:

Magic Moments

WP Password Argon Two just works when:

User passwords will be rehashed during the next login.

Requirements

Do Your Homework

Don't blindly trust any random security guide/plugin on the scary internet - including this one!

Do your research:

PHP 7.2+ and compiled --with-password-argon2

To check whether PHP is compiled with Argon2:

If you don't get the above output, either re-compile PHP 7.2+ with the flag --with-password-argon2 or:

Installation

Step 0

Read the whole source code before going any further.

Step 1

This plugin should not be installed as a normal WordPress plugin.

Option A: Via Composer Autoload (Recommended)

Note: Files in src will be autoloaded by composer. WP Password Argon Two won't appear in the WP admin dashboard.

Option B: As a Must-use Plugin (Last Resort)

Manually copy mu-plugins folder.

Step 2

Option A - Use Constants

Add these constants into wp-config.php:

Option B - Use Environment Variables

Defining the required constants in application code violates 12-factor principle. The typisttech/wp-password-argon-two-env package allows you to configure with environment variables.

Recommended for all Trellis users.

Usage

Pepper Migration

In some cases, you want to change the pepper without changing all user passwords.

During the next user login, his/her password will be rehashed with new-pepper.

Argon2i Options

Due to the variety of platforms PHP runs on, the cost factors are deliberately set low as to not accidentally exhaust system resources on shared or low resource systems when using the default cost parameters. Consequently, users should adjust the cost factors to match the system they're working on. As Argon2 doesn't have any "bad" values, however consuming more resources is considered better than consuming less. Users are encouraged to adjust the cost factors for the platform they're developing for.

-- PHP RFC

You can adjust the options via WP_PASSWORD_ARGON_TWO_OPTIONS:

Learn more about available options and picking appropriate options.

Uninstallation

You have to regenerate all user passwords after uninstallation because we can't rehash without knowing the passwords in plain text.

Frequently Asked Questions

What have you done with the passwords?

In a nutshell:

Don't take my word for it. Read the source code!

I have installed this plugin. Does it mean my WordPress site is unhackable?

No website is unhackable.

To have a secure WordPress site, you have to keep all these up-to-date:

Did you reinvent the cryptographic functions?

Of course not! This plugin use PHP's native functions.

Repeat: Read the source code!

Pepper migration look great. Does it mean that I can keep as many pepper keys as I want?

In a sense, yes, you could do that. However, each pepper slows down the login process a little bit.

To test the worst case, log in with an incorrect password.

What if my pepper is compromised?

  1. Remove that pepper from WP_PASSWORD_ARGON_TWO_PEPPER and WP_PASSWORD_ARGON_TWO_FALLBACK_PEPPERS
  2. Regenerate all user passwords

Is pepper-ing perfect?

No! Read paragonie's explaination.

For those who can't stand with the drawbacks, use one of the alternatives instead.

Is WordPress' phpass hasher or Bcrypt insecure?

Both WordPress' phpass hasher and Bcrypt are secure. There is no emergent reason to upgrade.

Learn more about the reasons about not using WordPress' default.

Why use Argon2i over the others?

Argon2 password-based key derivation function is the winner of the Password Hashing Competition in July 2015, ranked better than Bcrypt and PBKDF2.

Argon2 comes with 3 different modes: Argon2d, Argon2i, Argon2id. Argon2i is the one for password hashing. See: https://crypto.stackexchange.com/a/49969

Does this plugin has 72-character limit like Bcrypt?

No. Read the test.

It looks awesome. Where can I find some more goodies like this?

This plugin isn't on wp.org. Where can I give a :star::star::star::star::star: review?

Thanks!

Consider writing a blog post, submitting pull requests, donating or hiring me instead.

This plugin isn't on wp.org. Where can I make a complaint?

To be honest, I don't care.

If you really want to share your 1-star review, send me an email - in the first paragraph, state how many times I have told you to read the plugin source code.

Alternatives

Support!

Donate

Love WP Password Argon Two? Help me maintain it, a donation here can help with it.

Why don't you hire me?

Ready to take freelance WordPress jobs. Contact me via the contact form here or, via email [email protected]

Want to help in other way? Want to be a sponsor?

Contact: Tang Rufus

Developing

To setup a developer workable version you should run these commands:

To run the tests:

Feedback

Please provide feedback! We want to make this library useful in as many projects as possible. Please submit an issue and point out what you do and don't like, or fork the project and make suggestions. No issue is too small.

Change Log

Please see CHANGELOG for more information on what has changed recently.

Security

If you discover any security related issues, please email [email protected] instead of using the issue tracker.

Credits

WP Password Argon Two is a Typist Tech project and maintained by Tang Rufus, freelance developer for hire.

Full list of contributors can be found here.

License

The MIT License (MIT). Please see License File for more information.

All versions of wp-password-argon-two with dependencies

PHP Build Version
Package Version
Requires php Version ^7.2 || ^8.0
Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package typisttech/wp-password-argon-two contains the following files

Loading the files please wait ....