Magento 2: When/Why to do customer:hash:upgrade?

Question

When I run below command, it gives below output.

$ php bin/magento customer:hash:upgrade
.
Finished

1. What actually this command do?
2. When I have to run this command?
3. What changes it will do?
4. Will it increase more security?

I think it deals with the following class: magento\vendor\magento\framework\Encryption\Encryptor.php

/**
 * Key of md5 algorithm
 */
const HASH_VERSION_MD5 = 0;

/**
 * Key of sha256 algorithm
 */
const HASH_VERSION_SHA256 = 1;

Answer 1

Let's say you installed Magento 2 that has the following constants:

/**
 * Key of md5 algorithm
 */
const HASH_VERSION_MD5 = 0;

/**
 * Key of sha256 algorithm
 */
const HASH_VERSION_SHA256 = 1;

/**
 * Key of latest used algorithm
 */
const HASH_VERSION_LATEST = 1;

Later in time, you upgrade Magento and a new version of the used algorithm has been integrated in Magento 2 to increase security.

In that case, you can (need to?) run this command to upgrade the customer hash to used the latest hash algorithm.

So I assume Magento will add a notice when they upgrade the hash algorithm in the future version of Magento 2 and in that case you'll have to run this command to increase your customer security.

Answer 2

As @Raphael at Digital Pianism mention, It helps to increase customer security(Password security), you can check below code what Magento actually does when you run this command,

$this->collection = $this->customerCollectionFactory->create();
        $this->collection->addAttributeToSelect('*');
        $customerCollection = $this->collection->getItems();
        /** @var $customer Customer */
        foreach ($customerCollection as $customer) {
            $customer->load($customer->getId());
            if (!$this->encryptor->validateHashVersion($customer->getPasswordHash())) {
                list($hash, $salt, $version) = explode(Encryptor::DELIMITER, $customer->getPasswordHash(), 3);
                $version .= Encryptor::DELIMITER . Encryptor::HASH_VERSION_LATEST;
                $customer->setPasswordHash($this->encryptor->getHash($hash, $salt, $version));
                $customer->save();
                $output->write(".");
            }
        }
        $output->writeln(".");
        $output->writeln("<info>Finished</info>");

You can check from this file

vendor\magento\module-customer\Console\Command\UpgradeHashAlgorithmCommand.php

Answer 3

1. This Command upgraded customer's Hash according to latest Algorith in Magento 2
2. If you use migration tool and getting issue with login than you need to run this.