Every password write in my starter kit flows through one line on the User model:

protected function casts (): array { return [ 'email_verified_at' => 'datetime' , 'password' => 'hashed' , ]; }

Enter fullscreen mode

Exit fullscreen mode

Search my whole backend for Hash::make and you will find nothing. The only Hash call is Hash::check on login, which only reads. Nobody ever writes a hash by hand.

So the register endpoint does this:

$user = User :: create ([ 'name' => $request -> validated ( 'name' ), 'email' => $request -> validated ( 'email' ), 'password' => $request -> validated ( 'password' ), 'role' => 'user' , ]);

Enter fullscreen mode

Exit fullscreen mode

The controller passes the raw password straight through and the model hashes it before it touches the database. Same story in the admin create-user flow, and same in the seeder — DatabaseSeeder passes 'password' => 'password' in plain text and it lands hashed. The seeder does not know or care about bcrypt.

Two things I like about this.…