password_hash() — Native Bcrypt (PHP 5.5)

TL;DR

Explanation

password_hash($password, PASSWORD_BCRYPT) generates a bcrypt hash with automatic salting. password_verify($input, $hash) verifies. PASSWORD_DEFAULT currently means bcrypt but may change — store the full hash string including algorithm prefix. PHP 7.2+ adds PASSWORD_ARGON2I. PHP 7.3+ adds PASSWORD_ARGON2ID (preferred). password_needs_rehash($hash, PASSWORD_DEFAULT) checks if rehashing is needed after algorithm upgrades. Never: MD5/SHA1 for passwords, unsalted hashes, static salts, or reversible encryption for passwords.

Common Misconception

Why It Matters

Common Mistakes

• Using MD5($password) or SHA1($password) — crackable in seconds with rainbow tables.
• Not using password_needs_rehash() during login — fails to upgrade old hashes.
• Truncating passwords before hashing — bcrypt has 72-byte limit in older implementations.

Code Examples

$hash = md5($password); // Crackable instantly
$hash = md5($password . $salt); // Still fast, GPU-crackable
$hash = sha256($password); // Wrong tool — designed for speed

// Hash on registration:
$hash = password_hash($password, PASSWORD_ARGON2ID);

// Verify on login:
if (password_verify($inputPassword, $storedHash)) {
    // Upgrade hash if algorithm changed:
    if (password_needs_rehash($storedHash, PASSWORD_ARGON2ID)) {
        $newHash = password_hash($inputPassword, PASSWORD_ARGON2ID);
        // Store $newHash
    }
}

References

• ↗ https://www.php.net/manual/en/function.password-hash.php

Tags

Related Terms