wp_fast_hash() │ WP 6.8.0

Creates a cryptographically strong message hash using the BLAKE2b algorithm.

Use wp_verify_fast_hash() to verify the hash.

Use this function only for randomly generated values longer than 128 bits because it does not add a salt before hashing.

WordPress uses it to hash randomly generated security keys and application passwords. Hashing uses BLAKE2b from the Sodium library.

Do not use this function for user passwords. Use wp_hash_password().
Do not use it for low-entropy data such as short, simple, or predictable values. Use wp_hash() for those.

No Hooks.

Returns

String.

string - the message hash.

Usage

wp_fast_hash( string $message ): string;

$message(string) (required): Message to hash.

Has the #[\\SensitiveParameter] attribute, which hides the parameter value from logs. It protects sensitive data such as passwords. See: https://php.net/SensitiveParameter

Examples

#1 Creating and verifying the hash of a random key

$key  = bin2hex( random_bytes( 32 ) );
$hash = wp_fast_hash( $key );

$is_valid = wp_verify_fast_hash( $key, $hash );

Changelog

Since 6.8.0

Introduced.

`wp_fast_hash() wp fast hash` code ^{WP 7.0.4}

wp-includes/functions.php

function wp_fast_hash(
	#[\SensitiveParameter]
	string $message
): string {
	$hashed = sodium_crypto_generichash( $message, 'wp_fast_hash_6.8+', 30 );
	return '$generic$' . sodium_bin2base64( $hashed, SODIUM_BASE64_VARIANT_URLSAFE_NO_PADDING );
}