Skip to content

Conversation

MarcoPNS
Copy link

This PR adds comprehensive password hashing benchmarks to test the performance characteristics of PHP's built-in password hashing functions. The new benchmarks help developers make informed decisions about password hashing configurations in their applications.

Features added:

  • Bcrypt benchmarks with various cost parameters (4-12)
  • Argon2i benchmarks with different memory/time cost combinations
  • Argon2id benchmarks (modern variant) with various parameters
  • Password verification performance testing
  • Graceful fallbacks for unavailable algorithms

Why this matters:

  • Helps to choose appropriate cost parameters for their use case
  • Provides insights into performance implications of different hashing strategies
  • Assists in capacity planning by showing real-world hashing performance
  • Demonstrates the performance trade-offs between security and speed

@sergix44
Copy link
Owner

Can you please move the new file to an "extra" directory and add some docs in the readme?
Since that as you said, bcrypt or argon hashes are constant time functions that are not changing across hardware config or php version (in theory), so doesn't make much sense use that as a benchmark comparison, and are also increasing significantly how long the run takes.

@sergix44 sergix44 closed this Feb 3, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants