password_algos
Returns the IDs of every password hashing algorithm available in the current PHP build.
password_algos(): array- Added in PHP 7.4.0
Return value
arrayA list of the available password hashing algorithm IDs as strings, such as "2y", "argon2i" and "argon2id".
password_algos tells you which password hashing algorithms the PHP binary you are running on actually supports. It returns the raw string IDs that password_hash accepts, not the human-readable names: bcrypt is reported as 2y, and Argon2 appears as argon2i and argon2id.
The list is not fixed. Bcrypt is always present, but Argon2 is only there if PHP was compiled with libargon2 or with the sodium extension providing it. That is exactly why this function exists: shared hosting, distro packages and Docker images differ, and code that hardcodes PASSWORD_ARGON2ID will throw a ValueError on a build that lacks it.
When to reach for it
Use it in a capability check at boot or in a health-check endpoint: pick Argon2id when it is offered, otherwise fall back to bcrypt, and record which one you chose so your rehash logic stays consistent. Use it in installers and CI matrix tests to fail loudly on a build that cannot produce the hashes your database expects.
Do not use it to decide whether a stored hash is valid. To inspect an existing hash, use password_get_info instead.
Example
When to use it
- Detect at boot whether Argon2id is compiled in before choosing it as your hashing algorithm
- Fail an installer or deployment check early when a PHP build cannot produce the hash type your user table stores
- Render a diagnostics page showing which hashing algorithms a customer's server supports
Frequently asked questions
Why does password_algos return "2y" instead of "bcrypt"?
"2y" is the crypt identifier bcrypt hashes are prefixed with, and it is the exact value of the PASSWORD_BCRYPT constant since PHP 7.4. The human-readable name "bcrypt" is only returned by password_get_info under the algoName key.
Why is argon2id missing from password_algos on my server?
PHP was built without libargon2 support, so the algorithm is unavailable even though the PASSWORD_ARGON2ID constant is defined. Rebuild PHP with --with-password-argon2, install a distro package that includes it, or fall back to bcrypt.
Does password_algos include PASSWORD_DEFAULT?
No. PASSWORD_DEFAULT is an alias whose current value is "2y", so it appears in the list only because bcrypt does, not as a separate entry.
More examples
Pick the strongest algorithm the server offers
The output names the strongest algorithm this build supports and shows the resulting hash prefix. On a build with Argon2 you get "argon2id" and a hash starting "$argon2id$"; on a minimal build you get "2y" and "$2y$12$". The same code runs correctly on both.
<?php
function bestAlgo(): string
{
$algos = password_algos();
foreach ([PASSWORD_ARGON2ID, PASSWORD_ARGON2I, PASSWORD_BCRYPT] as $candidate) {
if (in_array($candidate, $algos, true)) {
return $candidate;
}
}
return PASSWORD_BCRYPT;
}
$algo = bestAlgo();
echo "Chosen algorithm: $algo\n";
$hash = password_hash('hunter2', $algo);
echo "Hash starts with: ", substr($hash, 0, 10), "\n";Report support as a diagnostics table
Each line pairs a friendly name with the ID string password_hash expects and whether this build accepts it. Note that PASSWORD_ARGON2I and PASSWORD_ARGON2ID are always defined as constants even when the algorithms are not compiled in, so the constant existing is not proof of support: only membership in password_algos() is.
<?php
$available = password_algos();
$known = [
'bcrypt' => PASSWORD_BCRYPT,
'argon2i' => PASSWORD_ARGON2I,
'argon2id' => PASSWORD_ARGON2ID,
];
foreach ($known as $label => $id) {
$ok = in_array($id, $available, true) ? 'yes' : 'no';
printf("%-9s (%s): %s\n", $label, $id, $ok);
}
Discussion