PHP crypt()
Function
Definition and Usage
The crypt()
function returns a string encrypted using the DES, Blowfish, or MD5 algorithms.
The behavior of this function differs on different operating systems, and some systems support more than one type of algorithm. At installation, PHP checks what algorithms are available and which one to use.
The exact algorithm depends on the format and length of the salt parameter. The salt can make the encryption more secure by increasing the number of strings generated by a specific encryption method with a specific string.
Here are some constants that can be used with the crypt()
function. These constant values are set by PHP at installation.
Constants:
[CRYPT_SALT_LENGTH] - The default encryption length. Using standard DES encryption, the length is 2.
[CRYPT_STD_DES] - Standard DES-based encryption with a 2-character salt from the alphabet "./0-9A-Za-z". Using invalid characters in the salt will cause the function to fail.
[CRYPT_EXT_DES] - Extended DES-based encryption with a 9-character salt, consisting of an underscore followed by 4 bytes of iteration count and 4 bytes of salt. These are encoded as printable characters, 6 bits each, with the least significant character first. Values 0 to 63 are encoded as "./0-9A-Za-z". Using invalid characters in the salt will cause the function to fail.
[CRYPT_MD5] - MD5 encryption with a 12-character salt, starting with $1$.
[CRYPT_BLOWFISH] - Blowfish encryption with a salt starting with $2a$, $2x$, or $2y$, a two-digit cost parameter "$", and 22 characters from the alphabet "./0-9A-Za-z". Using characters outside the alphabet will cause the function to return a string of length 0. The "$" parameter is the base-2 logarithm of the iteration count for the Blowfish hashing algorithm and must be in the range 04-31. Values outside this range will cause the function to fail.
[CRYPT_SHA_256] - SHA-256 encryption with a 16-character salt, starting with $5$.
[CRYPT_SHA_512] - SHA-512 encryption with a 16-character salt, starting with $6$.
On systems where the function supports multiple algorithms, the above constants are set to "1" if supported, otherwise "0".
Note: There is no corresponding decryption function. The crypt()
function uses a one-way algorithm.
Syntax
Parameter | Description |
---|---|
str | Required. Specifies the string to be encoded. |
salt | Optional. A string to increase the number of encoded characters, making the encoding more secure. If the salt parameter is not provided, a random one will be generated each time the function is called. |
Technical Details
Return Value: | Returns the encrypted string, or a string less than 13 characters long and guaranteed to be different from the salt if it fails. |
---|---|
PHP Version: | 4+ |
--- | --- |
Changelog: | In PHP 5.3.7, $2x$ and $2y$ Blowfish modes were added to handle potential high-bit attacks. <br> <br>In PHP 5.3.2, constants SHA-256 and SHA-512 were added. <br> <br>As of PHP 5.3.2, Blowfish returns a "failure" string ("0" or "1") for invalid rounds instead of falling back to DES. <br> <br>As of PHP 5.3.0, PHP comes with its own MD5, standard DES, extended DES, and Blowfish implementations. If the system does not support these algorithms, PHP's own implementations will be used. |
--- | --- |
Examples
Example 1
<?php
$hashed_password = crypt('mypassword'); // Automatically generates a salt
/* You should use the full result of crypt() as the salt when verifying passwords to avoid issues with different hashing algorithms. (As mentioned, standard DES-based password hashing uses a 2-character salt, while MD5-based hashing uses a 12-character salt.) */
if (hash_equals($hashed_password, crypt($user_input, $hashed_password))) {
echo "Password verified!";
}
?>
Example 2
Using crypt()
for htpasswd encryption:
<?php
// Set the password
$password = 'mypassword';
// Get the hash value, using an automatic salt
$hash = crypt($password);
?>
Example 1
In this example, we use different hash types:
<?php
if (CRYPT_STD_DES == 1) {
echo 'Standard DES: ' . crypt('rasmuslerdorf', 'rl') . "\n";
}
if (CRYPT_EXT_DES == 1) {
echo 'Extended DES: ' . crypt('rasmuslerdorf', '_J9..rasm') . "\n";
}
if (CRYPT_MD5 == 1) {
echo 'MD5: ' . crypt('rasmuslerdorf', '$1$rasmusle$') . "\n";
}
if (CRYPT_BLOWFISH == 1) {
echo 'Blowfish: ' . crypt('rasmuslerdorf', '$2a$07$usesomesillystringforsalt$') . "\n";
}
if (CRYPT_SHA256 == 1) {
echo 'SHA-256: ' . crypt('rasmuslerdorf', '$5$rounds=5000$usesomesillystringforsalt$') . "\n";
}
if (CRYPT_SHA512 == 1) {
echo 'SHA-512: ' . crypt('rasmuslerdorf', '$6$rounds=5000$usesomesillystringforsalt$') . "\n";
}
?>
The code above outputs the following (depending on the operating system):
Standard DES: rl.3StKT.4T8M
Extended DES: _J9..rasmBYk8r9AiWNc
MD5: $1$rasmusle$rISCgZzpwk3UhDidwXvin0
Blowfish: $2a$07$usesomesillystringfore2uDLvp1Ii2e./U9C8sBjqp8I90dH6hi
SHA-256: $5$rounds=5000$usesomesillystri$KqJWpanXZHKq2BOB43TSaYhEWsQ1Lr5QNyPCDH/Tp.6
SHA-512: $6$rounds=5000$usesomesillystri$D4IrlXatmP7rx3P3InaxBeoomnAihCKRVQP22JZ6EY47Wc6BkroIuUUBOov1i.S5KPgErtP/EN5mcO.ChWQW21