laravel/framework · error · RuntimeException

Could not verify the hashed value's configuration.

Error message

Could not verify the hashed value's configuration.

What it means

The 'hashed' cast calls Hash::verifyConfiguration() on values that are already hashed (skipping re-hash). If the hash cannot be matched against the currently configured driver/options, the framework refuses to persist it because silently storing an unverifiable hash would break later checks.

Source

Thrown at src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php:1505

     * @param  string  $key
     * @param  mixed  $value
     * @return string|null
     *
     * @throws \RuntimeException
     */
    protected function castAttributeAsHashedString($key, #[\SensitiveParameter] $value)
    {
        if ($value === null) {
            return null;
        }

        if (! Hash::isHashed($value)) {
            return Hash::make($value);
        }

        /** @phpstan-ignore staticMethod.notFound */
        if (! Hash::verifyConfiguration($value)) {
            throw new RuntimeException("Could not verify the hashed value's configuration.");
        }

        return $value;
    }

    /**
     * Decode the given float.
     *
     * @param  mixed  $value
     * @return mixed
     */
    public function fromFloat($value)
    {
        return match ((string) $value) {
            'Infinity' => INF,
            '-Infinity' => -INF,
            'NaN' => NAN,
            default => (float) $value,

View on GitHub (pinned to bd6b5437e6)

Solutions

1. Align the hashing driver/options (config/hashing.php, HASH_DRIVER env) with the source of the hash.
2. Re-hash the incoming value before assignment: $model->password = Hash::make($plainText) instead of passing a pre-hashed string.
3. If migrating legacy hashes, store them in a separate column and migrate with a rehash-on-login flow.

Example fix

// before
$user->password = '$2y$10$legacyHashFromOtherApp...'; // throws

// after
$user->password = Hash::make($request->password);
// or align config/hashing.php driver to match the source hashes

use Illuminate\Support\Facades\Hash;
if ($plainOrHashed !== null && ! Hash::isHashed($plainOrHashed)) {
    $plainOrHashed = Hash::make($plainOrHashed);
} elseif (Hash::isHashed($plainOrHashed) && ! Hash::verifyConfiguration($plainOrHashed)) {
    throw new \RuntimeException('Hash config mismatch; re-hash with current driver');
}
$model->password = $plainOrHashed;

function hashMatchesConfig(?string $h): bool
{
    return $h === null || ! \Illuminate\Support\Facades\Hash::isHashed($h) || \Illuminate\Support\Facades\Hash::verifyConfiguration($h);
}

try {
    $user->password = $value;
} catch (\RuntimeException $e) {
    if (str_contains($e->getMessage(), "hashed value's configuration")) {
        report('Hash driver mismatch on '.get_class($user));
        $user->password = \Illuminate\Support\Facades\Hash::make($plainTextFallback);
    } else {
        throw $e;
    }
}

When it happens

Trigger: Importing data containing hashes generated with a different driver (e.g. argon2i hashes while config uses bcrypt), seeding fixtures with hardcoded hashes from another stack, or rotating hashing config without rehashing existing records.

Common situations: Switching HASH_DRIVER/BCRYPT_ROUNDS between environments; copying users.password values from a legacy system or different Laravel app; CI with a different hashing config than production; mismatched 'argon' vs 'argon2id' defaults across PHP/Laravel versions.

Related errors

• Call to undefined cast [{$castType}] on column [{$column}] i
• The provided class must extend [{Collection::class}].
• The provided class must extend [{Collection::class}].
• The cast object for the {$attribute} attribute must implemen
• Value [%s] is not of the expected enum type [%s].

AI-assisted analysis of laravel/framework@bd6b5437e6 (2026-08-06). Data as JSON: /data/errors/c82fa8e89b590536.json. Report an issue: GitHub.