Authen...PHPass(3pm)

💖 Authen::Passphrase::PHPass(3pm) 💖

okay bestie, welcome to the User Contributed Perl Documentation for Authen::Passphrase::PHPass — it's giving password hashing, it's giving phpass, and honestly? it ate. let's get into it 🫶

---

✨ NAME ✨

Authen::Passphrase::PHPass — passphrases using the phpass algorithm. periodt.

---

🌸 SYNOPSIS 🌸

use Authen::Passphrase::PHPass;

$ppr = Authen::Passphrase::PHPass->new(
        cost => 10, salt => "NaClNaCl",
        hash_base64 => "ObRxTm/.EiiYN02xUeAQs/");

$ppr = Authen::Passphrase::PHPass->new(
        cost => 10, salt_random => 1,
        passphrase => "passphrase");

$ppr = Authen::Passphrase::PHPass->from_crypt(
        '$P$8NaClNaClObRxTm/.EiiYN02xUeAQs/');

$ppr = Authen::Passphrase::PHPass->from_rfc2307(
        '{CRYPT}$P$8NaClNaClObRxTm/.EiiYN02xUeAQs/');

$cost = $ppr->cost;
$cost_base64 = $ppr->cost_base64;
$cost = $ppr->nrounds_log2;
$cost_base64 = $ppr->nrounds_log2_base64;
$salt = $ppr->salt;
$hash = $ppr->hash;
$hash_base64 = $ppr->hash_base64;

if($ppr->match($passphrase)) { ...

$passwd = $ppr->as_crypt;
$userPassword = $ppr->as_rfc2307;

like… look at that. so clean. so iconic. 👑

---

🦋 DESCRIPTION 🦋

so an object of this class wraps up a passphrase that's been hashed with the phpass algorithm — invented by Solar Designer, described over at <http://www.openwall.com/phpass/>. it's a subclass of Authen::Passphrase, and this doc is just gonna assume you already know that class's lore, okay? iykyk.

the phpass algorithm is built on the MD5 message digest algorithm. there's an eight-byte salt, and conventionally it's restricted to being made of base 64 digits. there's also a cost parameter that controls how expensive the hashing is — yes bestie, this is the "make the attackers cry" knob 💀.

how the actual hashing goes:

1. the salt and the passphrase get concatenated and hashed with MD5.
2. then, 2^cost times, the hash from the previous stage gets concatenated with the passphrase and hashed with MD5 again.
3. the passphrase hash is whatever comes out of that final iteration. slay.

the passphrase hash gets represented in ASCII using the crypt format with the prefix "$P$". so, breaking it down:

• the first character after the format prefix is a base 64 digit that gives you the cost parameter.
• the next eight characters are the salt.
• the salt is followed by 22 base 64 digits giving the hash.

and the base 64 digits are ".", "/", "0" to "9", "A" to "Z", "a" to "z" — in ASCII order. 📝

---

💅 CONSTRUCTORS 💅

• Authen::Passphrase::PHPass->new(ATTR => VALUE, ...) — makes a brand new passphrase recogniser object using the phpass algorithm. here are the attributes you can hand it:
  • cost — base-two logarithm of the number of hashing rounds to perform.
  • cost_base64 — base-two logarithm of the number of hashing rounds to perform, but expressed as a single base 64 digit.
  • nrounds_log2 — synonym for cost. same thing, different name, we love flexibility.
  • nrounds_log2_base64 — synonym for cost_base64.
  • salt — the salt, as an eight-byte string.
  • salt_random — makes the salt get generated randomly. whatever value you give this attribute is ignored (yes, ignored, don't overthink it). the salt will be a string of eight base 64 digits. 🎲
  • hash — the hash, as a 16-byte string.
  • hash_base64 — the hash, as a string of 22 base 64 digits.
  • passphrase — a passphrase that will be accepted.

heads up bestie: the cost and salt must be given, plus either the hash or the passphrase. no skipping, no vibes-only construction. 🚨

• Authen::Passphrase::PHPass->from_crypt(PASSWD) — makes a new phpass passphrase recogniser object from a crypt string. the crypt string has to be "$P$", then one base 64 character encoding the cost, then the salt, then 22 base 64 digits giving the hash. the salt must be exactly 8 characters long, and it can't contain any character that isn't allowed to appear in a crypt string. strict queen behavior ✨
• Authen::Passphrase::PHPass->from_rfc2307(USERPASSWORD) — makes a new phpass passphrase recogniser object from an RFC 2307 string. the string has to be "{CRYPT}" (case insensitive, she's chill like that) followed by an acceptable crypt string.

---

🎀 METHODS 🎀

• $ppr->cost — returns the base-two logarithm of the number of hashing rounds that will be performed.
• $ppr->cost_base64 — returns the base-two logarithm of the number of hashing rounds that will be performed, expressed as a single base 64 digit.
• $ppr->nrounds_log2 — synonym for "cost".
• $ppr->nrounds_log2_base64 — synonym for "cost_base64".
• $ppr->salt — returns the salt, as a string of eight bytes.
• $ppr->hash — returns the hash value, as a string of 16 bytes.
• $ppr->hash_base64 — returns the hash value, as a string of 22 base 64 digits.
• $ppr->match(PASSPHRASE)
• $ppr->as_crypt
• $ppr->as_rfc2307

those last three — match(PASSPHRASE), as_crypt, and as_rfc2307 — are all part of the standard Authen::Passphrase interface. nothing new, just the classics. 💖

---

🌈 SEE ALSO 🌈

• Authen::Passphrase
• Digest::MD5

go read those too, bestie, they're the supporting cast 🫶

---

⭐ AUTHOR ⭐

Andrew Main (Zefram) <zefram@fysh.org>

---

👑 COPYRIGHT 👑

Copyright (C) 2006, 2007, 2009, 2010, 2012 Andrew Main (Zefram) <zefram@fysh.org>

---

💜 LICENSE 💜

This module is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

---

and that's the whole page, no cap 💅 this was perl v5.40.1, dated 2026-05-06, from Authen...PHPass(3pm) — stay hashed, stay iconic, mwah 🎀✨🦋