password_verify()

Also Known As

TL;DR

Explanation

password_verify($plaintext, $hash) compares a user-supplied password against a stored hash created by password_hash(). It automatically extracts the algorithm, cost, and salt from the stored hash string and is timing-safe. Never compare password hashes with == or === — this is vulnerable to timing attacks and type juggling. password_verify() always returns bool and handles all supported PHP password algorithms transparently.

Common Misconception

Why It Matters

Common Mistakes

• Comparing hashes with === instead of password_verify() — the embedded salt means the same password produces different hashes.
• Not calling password_needs_rehash() after a successful verify — misses the opportunity to upgrade old hashes.
• Using password_verify() to compare non-password hashes like HMACs — use hash_equals() for those.
• Assuming password_verify() is timing-safe against all attacks — it is, but only use it for password_hash() outputs.

Code Examples

// Wrong — hashing again and comparing:
$inputHash = password_hash($input, PASSWORD_BCRYPT);
if ($inputHash === $storedHash) { /* Always false — different salts */ }

// Correct:
if (password_verify($input, $storedHash)) { /* Correct */ }

// Constant-time, extracts salt from hash automatically
\$hash  = \$user->password; // from database
\$input = \$_POST['password'];

if (password_verify(\$input, \$hash)) {
    // Authenticated — check if rehash needed
    if (password_needs_rehash(\$hash, PASSWORD_ARGON2ID, ['memory_cost' => 65536])) {
        \$new = password_hash(\$input, PASSWORD_ARGON2ID);
        User::where('id', \$user->id)->update(['password' => \$new]);
    }
} else {
    // Wrong password — use identical code path as 'user not found' to prevent enumeration
    abort(401, 'Invalid credentials');
}

References

• ↗ https://www.php.net/manual/en/function.password-verify.php

Tags

Related Terms