hash_algos
Returns a list of every hashing algorithm the current PHP build supports.
hash_algos(): array- Added in PHP 5.1.2
Return value
arrayA numerically indexed array of the names of the supported hashing algorithms.
Errors
Nothing.
Changelog
- PHP 8.1.0Support for the MurmurHash3 and xxHash algorithms was added.
- PHP 7.4.0Support for crc32c was added.
- PHP 7.1.0Support for sha512/224, sha512/256, sha3-224, sha3-256, sha3-384 and sha3-512 was added.
hash_algos() returns the exact set of algorithm names that hash(), hash_file() and hash_init() will accept on this machine. The list is baked in at build time and differs between PHP versions and distributions, so it is the only trustworthy source of truth.
When to reach for it
Call it before passing a user-supplied or configured algorithm name to hash(), so a typo becomes a clean error message instead of an uncaught ValueError. It is also useful in a diagnostics or health-check page — printing the list tells you instantly whether the server is new enough to offer xxh3 or sha3-256.
What trips people up
The list is not the list of algorithms valid for hash_hmac(). Non-cryptographic entries such as crc32b, adler32, fnv1a64, murmur3f and the xxHash family appear here but were disabled for HMAC in PHP 7.2. Use hash_hmac_algos() when validating an HMAC algorithm.
Also, names are compared case-insensitively by hash() but are returned lowercase here, so use in_array(strtolower($algo), hash_algos(), true) if the name might arrive capitalised.
Example
When to use it
- Validate an algorithm name from config before calling hash().
- Show supported algorithms on an admin diagnostics page.
- Pick the strongest available algorithm at runtime across mixed server versions.
Frequently asked questions
Why is an algorithm missing from hash_algos?
The list depends on how PHP was compiled and on the version — sha3 arrived in 7.1, crc32c in 7.4, and xxHash and MurmurHash3 in 8.1. Upgrade PHP or rebuild the hash extension to get newer entries.
What is the difference between hash_algos and hash_hmac_algos?
hash_algos() lists everything hash() accepts, including non-cryptographic checksums. hash_hmac_algos() is the smaller subset that hash_hmac() will accept, since PHP 7.2 rejects non-cryptographic algorithms for HMAC.
Does hash_algos tell me which algorithm is most secure?
No, it is an unordered list with no strength information. As a rule prefer sha256 or sha3-256 for security work and treat crc32b, adler32 and the xxHash family as non-cryptographic.
More examples
Pick the best algorithm the server offers
The function walks a preference list and returns the first name the build actually supports, so the same code runs on an old and a new PHP without a fatal error.
<?php
function bestAlgo(array $preferred): string {
$available = hash_algos();
foreach ($preferred as $algo) {
if (in_array($algo, $available, true)) {
return $algo;
}
}
return 'sha256';
}
$algo = bestAlgo(['sha3-512', 'sha512', 'sha256']);
echo "using $algo", PHP_EOL;
echo hash($algo, 'payload'), PHP_EOL;Group the list by family
The output shows which families the build carries. An empty 'fast' xxHash section means the server predates PHP 8.1, which is a quick way to spot version drift between environments.
<?php
$groups = ['sha3' => [], 'sha2' => [], 'fast' => []];
foreach (hash_algos() as $a) {
if (str_starts_with($a, 'sha3')) { $groups['sha3'][] = $a; }
elseif (str_starts_with($a, 'sha2') || str_starts_with($a, 'sha5')) { $groups['sha2'][] = $a; }
elseif (str_starts_with($a, 'xxh') || str_starts_with($a, 'crc')) { $groups['fast'][] = $a; }
}
foreach ($groups as $name => $list) {
echo $name, ': ', implode(', ', $list), PHP_EOL;
}
Discussion