{"id":"c82fa8e89b590536","repo":"laravel/framework","slug":"could-not-verify-the-hashed-value-s-configuration","errorCode":null,"errorMessage":"Could not verify the hashed value's configuration.","messagePattern":"Could not verify the hashed value's configuration\\.","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php","lineNumber":1505,"sourceCode":"     * @param  string  $key\n     * @param  mixed  $value\n     * @return string|null\n     *\n     * @throws \\RuntimeException\n     */\n    protected function castAttributeAsHashedString($key, #[\\SensitiveParameter] $value)\n    {\n        if ($value === null) {\n            return null;\n        }\n\n        if (! Hash::isHashed($value)) {\n            return Hash::make($value);\n        }\n\n        /** @phpstan-ignore staticMethod.notFound */\n        if (! Hash::verifyConfiguration($value)) {\n            throw new RuntimeException(\"Could not verify the hashed value's configuration.\");\n        }\n\n        return $value;\n    }\n\n    /**\n     * Decode the given float.\n     *\n     * @param  mixed  $value\n     * @return mixed\n     */\n    public function fromFloat($value)\n    {\n        return match ((string) $value) {\n            'Infinity' => INF,\n            '-Infinity' => -INF,\n            'NaN' => NAN,\n            default => (float) $value,","sourceCodeStart":1487,"sourceCodeEnd":1523,"githubUrl":"https://github.com/laravel/framework/blob/bd6b5437e6ad87bb49f9b426724f07a9f64e9683/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php#L1487-L1523","documentation":"The 'hashed' cast calls Hash::verifyConfiguration() on values that are already hashed (skipping re-hash). If the hash cannot be matched against the currently configured driver/options, the framework refuses to persist it because silently storing an unverifiable hash would break later checks.","triggerScenarios":"Importing data containing hashes generated with a different driver (e.g. argon2i hashes while config uses bcrypt), seeding fixtures with hardcoded hashes from another stack, or rotating hashing config without rehashing existing records.","commonSituations":"Switching HASH_DRIVER/BCRYPT_ROUNDS between environments; copying users.password values from a legacy system or different Laravel app; CI with a different hashing config than production; mismatched 'argon' vs 'argon2id' defaults across PHP/Laravel versions.","solutions":["Align the hashing driver/options (config/hashing.php, HASH_DRIVER env) with the source of the hash.","Re-hash the incoming value before assignment: $model->password = Hash::make($plainText) instead of passing a pre-hashed string.","If migrating legacy hashes, store them in a separate column and migrate with a rehash-on-login flow."],"exampleFix":"// before\n$user->password = '$2y$10$legacyHashFromOtherApp...'; // throws\n\n// after\n$user->password = Hash::make($request->password);\n// or align config/hashing.php driver to match the source hashes","handlingStrategy":"validation","validationCode":"use Illuminate\\Support\\Facades\\Hash;\nif ($plainOrHashed !== null && ! Hash::isHashed($plainOrHashed)) {\n    $plainOrHashed = Hash::make($plainOrHashed);\n} elseif (Hash::isHashed($plainOrHashed) && ! Hash::verifyConfiguration($plainOrHashed)) {\n    throw new \\RuntimeException('Hash config mismatch; re-hash with current driver');\n}\n$model->password = $plainOrHashed;","typeGuard":"function hashMatchesConfig(?string $h): bool\n{\n    return $h === null || ! \\Illuminate\\Support\\Facades\\Hash::isHashed($h) || \\Illuminate\\Support\\Facades\\Hash::verifyConfiguration($h);\n}","tryCatchPattern":"try {\n    $user->password = $value;\n} catch (\\RuntimeException $e) {\n    if (str_contains($e->getMessage(), \"hashed value's configuration\")) {\n        report('Hash driver mismatch on '.get_class($user));\n        $user->password = \\Illuminate\\Support\\Facades\\Hash::make($plainTextFallback);\n    } else {\n        throw $e;\n    }\n}","preventionTips":["Keep HASH_DRIVER and hashing.php consistent across environments.","Never copy pre-hashed values across apps; re-hash the plaintext.","Implement rehash-on-login when migrating hashing algorithms."],"tags":["eloquent","cast","hash","security","config","password"],"analyzedSha":"bd6b5437e6ad87bb49f9b426724f07a9f64e9683","analyzedAt":"2026-08-06T00:28:32.783Z","schemaVersion":2}