Sign in Get started

Laravel Tutorial · Beyond the Basics · Lesson 20 of 27

Authentication

How users sign in with Laravel: hashed passwords, Auth::attempt, the current user, starter kits for full login flows, and Sanctum for API tokens.

Create a free account to save this page, take notes and track your progress. Sign in

Don't build it from scratch

New projects get complete login, registration, password reset and email verification from a starter kit (laravel new offers React, Vue and Livewire kits). For APIs and mobile apps, Laravel Sanctum issues API tokens (php artisan install:api), and Socialite adds "Sign in with Google/GitHub".

The building blocks

  • Passwords are stored with Hash::make() (bcrypt or argon2) and checked with Hash::check(); never store plain passwords.
  • Auth::attempt(['email' => $e, 'password' => $p]) checks credentials and signs the user in to the session.
  • Auth::user(), Auth::id(), Auth::check() and $request->user() give the current user.
  • ->middleware('auth') protects routes; Auth::logout() signs out.
  • Regenerate the session after login ($request->session()->regenerate()) to prevent session fixation.
Hashing passwords and signing in
<?php
use App\Models\User;
use Illuminate\Database\Schema\Blueprint;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\Hash;
use Illuminate\Support\Facades\Schema;

Schema::create('users', function (Blueprint $t) {
    $t->id();
    $t->string('name');
    $t->string('email')->unique();
    $t->string('password');
    $t->rememberToken();
    $t->timestamps();
});

$user = User::create(['name' => 'Ana', 'email' => '[email protected]', 'password' => 'correct-horse-9']);

echo 'stored password starts with: ', substr($user->password, 0, 4), ' (a bcrypt hash, not the password)', "\n";
echo 'hash check: ', Hash::check('correct-horse-9', $user->password) ? 'match' : 'no match', "\n";

echo 'wrong password: ', Auth::attempt(['email' => '[email protected]', 'password' => 'guess']) ? 'signed in' : 'rejected', "\n";
echo 'right password: ', Auth::attempt(['email' => '[email protected]', 'password' => 'correct-horse-9']) ? 'signed in' : 'rejected', "\n";
echo 'current user: ', Auth::user()->name, ' (id ', Auth::id(), ')', "\n";

Auth::logout();
echo 'after logout, signed in? ', Auth::check() ? 'yes' : 'no', "\n";

Output

stored password starts with: $2y$ (a bcrypt hash, not the password)
hash check: match
wrong password: rejected
right password: signed in
current user: Ana (id 1)
after logout, signed in? no

Run this on your computer — see “Get Started” for setup.

With Sanctum, mobile clients send Authorization: Bearer <token> and routes use ->middleware('auth:sanctum'); $user->createToken('phone')->plainTextToken creates a token.

Test yourself

How should Laravel store user passwords?

  1. Encrypted with Crypt::encrypt
  2. As hashes made with Hash::make (bcrypt/argon2)
  3. In plain text in .env
  4. Base64-encoded
Show answer

Answer: As hashes made with Hash::make (bcrypt/argon2)

Was this page helpful?