---
title: "Deprecation: #102763 - Extbase HashService"
manual: "TYPO3 Core Changelog"
version: "main"
permalink: "https://docs.typo3.org/permalink/changelog:deprecation-102763-1706358913"
source: "Changelog/13.0/Deprecation-102763-ExtbaseHashService.rst"
typo3-version: "13.0"
typo3-major: 13
type: "deprecation"
issue: 102763
forge: "https://forge.typo3.org/issues/102763"
tags: ["PHP-API", "FullyScanned", "ext:extbase"]
rendered: "2026-09-20T18:31:11+00:00"
---

# Deprecation: #102763 - Extbase HashService {#deprecation-102763-1706358913}

See [forge#102763](https://forge.typo3.org/issues/102763)

## Description {#description}

Internal class `\TYPO3\CMS\Extbase\Security\Cryptography\HashService`
is deprecated in favor of `\TYPO3\CMS\Core\Crypto\HashService`,
which requires an additional secret to prevent re-using generated hashes in
different contexts.

## Impact {#impact}

Using class `\TYPO3\CMS\Extbase\Security\Cryptography\HashService` will
trigger a PHP deprecation warning.

## Affected installations {#affected-installations}

TYPO3 installations with custom extensions using
`\TYPO3\CMS\Extbase\Security\Cryptography\HashService`.

## Migration {#migration}

Class `\TYPO3\CMS\Core\Crypto\HashService` must be used to migrate.

### Before {#before}

```php
$hashService = new \TYPO3\CMS\Extbase\Security\Cryptography\HashService();

$generatedHash = $hashService->generateHmac('123');
$isValidHash = $hashService->validateHmac('123', $generatedHash);

$stringWithAppendedHash = $hashService->appendHmac('123');
$validatedStringWithHashRemoved = $hashService->validateAndStripHmac($stringWithAppendedHash);
```

### After {#after}

```php
$hashService = new \TYPO3\CMS\Core\Crypto\HashService();

$generatedHash = $hashService->hmac('123', 'myAdditionalSecret');
$isValidHash = $hashService->validateHmac('123', 'myAdditionalSecret', $generatedHash);

$stringWithAppendedHash = $hashService->appendHmac('123', 'myAdditionalSecret');
$validatedStringWithHashRemoved = $hashService->validateAndStripHmac($stringWithAppendedHash, 'myAdditionalSecret');
```

Note, `$additionalSecret` string must be unique per
context, so hashes for the same input are different depending on scope.