---
title: "Deprecation: #85804 - Salted password hash class deprecations"
manual: "TYPO3 Core Changelog"
version: "main"
permalink: "https://docs.typo3.org/permalink/changelog:deprecation-85804"
source: "Changelog/9.4/Deprecation-85804-SaltedPasswordHashClassDeprecations.rst"
modified: "2026-09-14T09:47:36+00:00"
---

# Deprecation: #85804 - Salted password hash class deprecations

See [forge#85804](https://forge.typo3.org/issues/85804)

## Description

Selecting the hash algorithm used to store frontend and backend user hashes is
now a "preset" and can be changed using "Admin tools" -> "Settings" -> "Configuration Presets".

Existing settings are updated automatically when upgrading from an older TYPO3 version to
TYPO3 v9. The detail list below is only interesting for instances that need to
run custom hash mechanisms.

The password hash mechanism used for backend user passwords has been moved from
`$GLOBALS['TYPO3_CONF_VARS']['EXTENSIONS']['saltedpasswords']['BE']['saltedPWHashingMethod']`
to `$GLOBALS['TYPO3_CONF_VARS']['BE']['passwordHashing']['className']`. Options for a specific
hash algorithms can be defined using `$GLOBALS['TYPO3_CONF_VARS']['BE']['passwordHashing']['options']`.

The password hash mechanism used for frontend user passwords has been moved from
`$GLOBALS['TYPO3_CONF_VARS']['EXTENSIONS']['saltedpasswords']['FE']['saltedPWHashingMethod']`
to `$GLOBALS['TYPO3_CONF_VARS']['FE']['passwordHashing']['className']`. Options for a specific
hash algorithms can be defined using `$GLOBALS['TYPO3_CONF_VARS']['FE']['passwordHashing']['options']`.

Custom password hash algorithms should now be registered in
`$GLOBALS['TYPO3_CONF_VARS']['SYS']['availablePasswordHashAlgorithms']`.
The usage of the former array entry
`$GLOBALS['TYPO3_CONF_VARS']['SC_OPTIONS']['ext/saltedpasswords']['saltMethods']` has been marked as deprecated.

These interfaces and classes have been marked as deprecated and should not be implemented any longer:

-   `\TYPO3\CMS\Saltedpasswords\Salt\ComposedSaltInterface`
-   `\TYPO3\CMS\Saltedpasswords\Salt\AbstractComposedSalt`
-   `\TYPO3\CMS\Saltedpasswords\Salt\Utility\ExtensionManagerConfigurationUtility`
-   `\TYPO3\CMS\Saltedpasswords\Salt\Utility\SaltedPasswordsUtility`

An interface has been changed:

-   `TYPO3\CMS\Saltedpasswords\Salt\SaltInterface->getHashedPassword(string $password)` \- The
    second argument has been dropped. Classes implementing the interface should remove the second argument.

These methods have been marked as deprecated:

-   `TYPO3\CMS\Saltedpasswords\Salt\Argon2iSalt->getOptions()`
-   `TYPO3\CMS\Saltedpasswords\Salt\Argon2iSalt->setOptions()`
-   `TYPO3\CMS\Saltedpasswords\Salt\BcryptSalt->getOptions()`
-   `TYPO3\CMS\Saltedpasswords\Salt\BcryptSalt->setOptions()`
-   `TYPO3\CMS\Saltedpasswords\Salt\BlowfishSalt->getHashCount()`
-   `TYPO3\CMS\Saltedpasswords\Salt\BlowfishSalt->getMaxHashCount()`
-   `TYPO3\CMS\Saltedpasswords\Salt\BlowfishSalt->getMinHashCount()`
-   `TYPO3\CMS\Saltedpasswords\Salt\BlowfishSalt->getSaltLength()`
-   `TYPO3\CMS\Saltedpasswords\Salt\BlowfishSalt->getSetting()`
-   `TYPO3\CMS\Saltedpasswords\Salt\BlowfishSalt->setHashCount()`
-   `TYPO3\CMS\Saltedpasswords\Salt\BlowfishSalt->setMaxHashCount()`
-   `TYPO3\CMS\Saltedpasswords\Salt\BlowfishSalt->setMinHashCount()`
-   `TYPO3\CMS\Saltedpasswords\Salt\Md5Salt->getSetting()`
-   `TYPO3\CMS\Saltedpasswords\Salt\Md5Salt->getSaltLength()`
-   `TYPO3\CMS\Saltedpasswords\Salt\Pbkdf2Salt->getHashCount()`
-   `TYPO3\CMS\Saltedpasswords\Salt\Pbkdf2Salt->getMaxHashCount()`
-   `TYPO3\CMS\Saltedpasswords\Salt\Pbkdf2Salt->getMinHashCount()`
-   `TYPO3\CMS\Saltedpasswords\Salt\Pbkdf2Salt->getSaltLength()`
-   `TYPO3\CMS\Saltedpasswords\Salt\Pbkdf2Salt->getSetting()`
-   `TYPO3\CMS\Saltedpasswords\Salt\Pbkdf2Salt->setHashCount()`
-   `TYPO3\CMS\Saltedpasswords\Salt\Pbkdf2Salt->setMaxHashCount()`
-   `TYPO3\CMS\Saltedpasswords\Salt\Pbkdf2Salt->setMinHashCount()`
-   `TYPO3\CMS\Saltedpasswords\Salt\PhpassSalt->getHashCount()`
-   `TYPO3\CMS\Saltedpasswords\Salt\PhpassSalt->getMaxHashCount()`
-   `TYPO3\CMS\Saltedpasswords\Salt\PhpassSalt->getMinHashCount()`
-   `TYPO3\CMS\Saltedpasswords\Salt\PhpassSalt->getSaltLength()`
-   `TYPO3\CMS\Saltedpasswords\Salt\PhpassSalt->getSetting()`
-   `TYPO3\CMS\Saltedpasswords\Salt\PhpassSalt->setHashCount()`
-   `TYPO3\CMS\Saltedpasswords\Salt\PhpassSalt->setMaxHashCount()`
-   `TYPO3\CMS\Saltedpasswords\Salt\PhpassSalt->setMinHashCount()`

These methods changed their signature:

-   `TYPO3\CMS\Saltedpasswords\Salt\BlowfishSalt->getHashedPassword()` \- Second argument marked as deprecated
-   `TYPO3\CMS\Saltedpasswords\Salt\Md5Salt->getHashedPassword()` \- Second argument marked as deprecated
-   `TYPO3\CMS\Saltedpasswords\Salt\Pbkdf2Salt->getHashedPassword()` \- Second argument marked as deprecated
-   `TYPO3\CMS\Saltedpasswords\Salt\PhpassSalt->getHashedPassword()` \- Second argument marked as deprecated

These methods changed their visibility from public to protected:

-   `TYPO3\CMS\Saltedpasswords\Salt\BlowfishSalt->isValidSalt()`
-   `TYPO3\CMS\Saltedpasswords\Salt\BlowfishSalt->base64Encode()`
-   `TYPO3\CMS\Saltedpasswords\Salt\Md5Salt->isValidSalt()`
-   `TYPO3\CMS\Saltedpasswords\Salt\Md5Salt->base64Encode()`
-   `TYPO3\CMS\Saltedpasswords\Salt\Pbkdf2Salt->isValidSalt()`
-   `TYPO3\CMS\Saltedpasswords\Salt\Pbkdf2Salt->base64Encode()`
-   `TYPO3\CMS\Saltedpasswords\Salt\Pbkdf2Salt->base64Decode()`
-   `TYPO3\CMS\Saltedpasswords\Salt\PhpassSalt->isValidSalt()`
-   `TYPO3\CMS\Saltedpasswords\Salt\PhpassSalt->base64Encode()`

These class constants have been marked as deprecated and will be removed in TYPO3 v10:

-   `TYPO3\CMS\Saltedpasswords\Salt\BlowfishSalt::ITOA64`
-   `TYPO3\CMS\Saltedpasswords\Salt\BlowfishSalt::HASH_COUNT`
-   `TYPO3\CMS\Saltedpasswords\Salt\BlowfishSalt::MAX_HASH_COUNT`
-   `TYPO3\CMS\Saltedpasswords\Salt\BlowfishSalt::MIN_HASH_COUNT`
-   `TYPO3\CMS\Saltedpasswords\Salt\Md5Salt::ITOA64`
-   `TYPO3\CMS\Saltedpasswords\Salt\Pbkdf2Salt::ITOA64`
-   `TYPO3\CMS\Saltedpasswords\Salt\Pbkdf2Salt::HASH_COUNT`
-   `TYPO3\CMS\Saltedpasswords\Salt\Pbkdf2Salt::MAX_HASH_COUNT`
-   `TYPO3\CMS\Saltedpasswords\Salt\Pbkdf2Salt::MIN_HASH_COUNT`
-   `TYPO3\CMS\Saltedpasswords\Salt\PhpassSalt::ITOA64`
-   `TYPO3\CMS\Saltedpasswords\Salt\PhpassSalt::HASH_COUNT`
-   `TYPO3\CMS\Saltedpasswords\Salt\PhpassSalt::MAX_HASH_COUNT`
-   `TYPO3\CMS\Saltedpasswords\Salt\PhpassSalt::MIN_HASH_COUNT`

## Impact

Using functionality from the above list will trigger PHP `E_USER_DEPRECATED` errors.

## Affected Installations

Almost no TYPO3 instances are directly affected by the changes outlined above. A configuration
upgrade is in place to move from old to new settings when calling the install tool the first time
after upgrade without further user interaction.

If in rare cases an existing TYPO3 instance runs custom salt mechanisms, the extension scanner
will find affected code places that should be adapted.

## Migration

If the extension scanner finds affected code, adapt the method calls, class constant usages and interface usages.