zonuexe/apr1-md5

Apache's APR1-MD5 algorithm in pure PHP

2.0.0 2022-12-21 09:45 UTC

Requires

• php: >=7.3

Requires (Dev)

• phpstan/phpstan: ^1.9
• phpunit/phpunit: ^9.5 || ^7.5

MIT

• Jeremy Ebler
• USAMI Kenta

• MD5
• apr1

README

There is no way that the best way to generate Apache's apr1-md5 password hashes is from a 7-year-old comment on php.net. Only a n00b would trust a crypto algorithm from a non-security website's forum. Sadly, that is how the PHP community has accessed this algorithm, until now.

Here is a tested, referenced, documented, and packaged implementation of Apache's APR1 MD5 Hashing Algorithm in pure PHP.

Install

composer.json:

{
    "require": {
        "zonuexe/apr1-md5": "~1.0"
    }
}

Use

use zonuexe\Apr1md5;

// Check plaintext password against an APR1-MD5 hash
echo Apr1md5::check('plaintext', '$apr1$PVWlTz/5$SNkIVyogockgH65nMLn.W1');

// Hash a password with a known salt
echo Apr1md5::hash('PASSWORD', '__SALT__');

// Hash a password with a secure random salt
echo Apr1md5::hash('PASSWORD');

// Generate a secure random salt
echo Apr1md5::salt();

The ideal __SALT__ is an 8 character string. Valid salts are alphanumeric and . or /. Shorter salts are allowed. Longer salts are truncated after the 8th character.

Generate Hashes via Other Tools

htpasswd

$ htpasswd -nmb apache apache
apache:$apr1$rOioh4Wh$bVD3DRwksETubcpEH90ww0

$ htpasswd -nmb ChangeMe1 ChangeMe1
ChangeMe1:$apr1$PVWlTz/5$SNkIVyogockgH65nMLn.W1

$ htpasswd -nmb WhiteHat101 WhiteHat101
WhiteHat101:$apr1$HIcWIbgX$G9YqNkCVGlFAN63bClpoT/

openssl

$ openssl passwd -apr1 -salt rOioh4Wh apache
$apr1$rOioh4Wh$bVD3DRwksETubcpEH90ww0

$ openssl passwd -apr1 -salt PVWlTz/5 ChangeMe1
$apr1$PVWlTz/5$SNkIVyogockgH65nMLn.W1

$ openssl passwd -apr1 -salt HIcWIbgX WhiteHat101
$apr1$HIcWIbgX$G9YqNkCVGlFAN63bClpoT/

Testing

composer install
vendor/bin/phpunit