Password value object that can be either hashed or raw - php

Question

I've got the following value object (VO) Password. The password must be between 6 and 20 characters. But since my UserMapper is hashing the password before persisting the entity, I have no idea what validation logic I should have in this VO.
When UserMapper returns a User, the password is in a hashed form which is 60 characters long.
Does that mean I have to take into consideration both of these scenarios in my value object? Currently it would throw an InvalidArgumentException exception because the value would not be between 6 and 20 chars but 60 characters long (hashed).
namespace Models\Values\User;
use \InvalidArgumentException;
class Password
{
private $min = 6;
private $max = 20;
private $password;
public function __construct($password)
{
if (is_string($password) && !empty($password)) {
$length = $this->stringLength($password);
if ($length >= $this->min && $length <= $this->max) {
$this->password = $password;
}
} else {
throw new InvalidArgumentException(sprintf('%s must be a string from %s to %s characters.', __METHOD__, $this->min, $this->max));
}
}
public function __toString()
{
return $this->password;
}
private function stringLength($string)
{
$encoding = mb_detect_encoding($string);
$length = mb_strlen($string, $encoding);
return $length;
}
}

Answer 1

I agree with #kingkero in the comment above: Make that two different classes.
I suggest that HashedPassword is only creatable through a factory method on Password (possibly using a PasswordHashAlgorithm service given as an argument), which will be used to create a hashed password after Password has validated the input. Only HashedPasswords are persisted.

Answer 2

Client side password validation on the length could be on the textbox that contains the password string item.
After that, it should be considered a safe password (if the password store accepts it).
After that you should not set or get passwords from the password storage, but ask the store to verify the password for you.
So I think you are too late in checking the password strength, unless you can do it sooner.