Easy Tutorial
❮ Func Math Abs Php Imagecolormatch ❯

PHP password_hash() Function

PHP Password Hashing Algorithm

The password_hash() function is used to create a hash of a password.

PHP Version Requirements: PHP 5 >= 5.5.0, PHP 7

Syntax

string password_hash ( string $password , int $algo [, array $options ] )

password_hash() creates a hash using a strong one-way hashing algorithm. password_hash() is compatible with crypt(). Therefore, password hashes created by crypt() can be used with password_hash().

Supported Algorithms:

-

-

-

PASSWORD_BCRYPT Supported Options:

-

salt (string) - Manually provides a salt for hashing the password. This will prevent the automatic generation of a salt.

Omitting this value, password_hash() will automatically generate a random salt for each password hash. This behavior is intentional.

Note: The salt option has been deprecated as of PHP 7.0.0. It is now better to simply use the default generated salt.

-

cost (integer) - Represents the cost used by the algorithm. Examples of cost values can be found on the crypt() page.

When omitted, the default value is 10. This cost is a good baseline, but may be increased based on hardware capabilities.

PASSWORD_ARGON2I Supported Options:

-

memory_cost (** .

-

time_cost (** .

-

threads (** .

Parameter Description:

-

password: A hash value created by password_hash().

-

algo: A password algorithm constant indicating the algorithm to use when hashing the password.

-

options: An associative array containing options. Currently supports two options: salt, the salt added when hashing the password (interference string), and cost, which indicates the number of algorithm recursions. Examples of these values can be found on the crypt() page.

When omitted, a random salt and default cost will be used.

Return Value

Returns the hashed password, or FALSE on failure.

Examples

Example 1

<?php
/**
 * We want to hash the password using the default algorithm
 * Currently, this is BCRYPT, which will produce a 60-character result.
 *
 * Note that the default algorithm may change over time,
 * so the storage space should be able to accommodate more than 60 characters (255 characters is good).
 */
echo password_hash("rasmuslerdorf", PASSWORD_DEFAULT);
?>

Output:

$2y$10$.vGA1O9wmRjrwAVXD98HNOgsNpDczlqm3Jq7KnEd1rVAGv3Fykk1a

Example 2

<?php
/**
 * In this case, we increase the cost for BCRYPT to 12.
 * Note that this will always produce a 60-character result.
 */
$options = [
    'cost' => 12,
];
echo password_hash("rasmuslerdorf", PASSWORD_BCRYPT, $options);
?>

Output:

$2y$12$QjSH496pcT5CEbzjD/vtVeH03tfHKFy36d4J0Ltp3lRtee9HDxY3K

Example 3

Example of manually setting the salt

<?php
/**
 * Note that the salt here is randomly generated.
 * Never use a fixed salt or one that is not randomly generated.
 *
 * In most cases, let password_hash generate the random salt for you.
 */
$options = [
    'cost' => 11,
    'salt' => mcrypt_create_iv(22, MCRYPT_DEV_URANDOM),
];
echo password_hash("rasmuslerdorf", PASSWORD_BCRYPT, $options);
?>

Output:

$2y$11$q5MkhSBtlsJcNEVsYh64a.aCluzHnGog7TQAKVmQwO9C8xb.t89F.

Example 4

Example of finding the optimal cost for password_hash()

<?php
/**
 * This example benchmarks the server to determine the highest cost
 * that can be set without significantly slowing down the server.
 * 8-10 is a good baseline, and the higher the better, depending on server performance.
 */
$timeTarget = 0.05; // 50 milliseconds 

$cost = 8;
do {
    $cost++;
    $start = microtime(true);
    password_hash("test", PASSWORD_BCRYPT, ["cost" => $cost]);
    $end = microtime(true);
} while (($end - $start) < $timeTarget);

echo "Optimal cost: " . $cost;
?>

Output:

Optimal cost: 10
/*
 * The target for the following code is ≤ 50 milliseconds.
 * Suitable for system processing interactive logins.
 */
$timeTarget = 0.05; // 50 milliseconds

$cost = 8;
do {
    $cost++;
    $start = microtime(true);
    password_hash("test", PASSWORD_BCRYPT, ["cost" => $cost]);
    $end = microtime(true);
} while (($end - $start) < $timeTarget);

echo "Appropriate Cost Found: " . $cost;
?>

Output result:

Appropriate Cost Found: 10

Example 5

Using Argon2 example:

<?php
echo 'Argon2 hash: ' . password_hash('rasmuslerdorf', PASSWORD_ARGON2I);
?>

Output result:

Argon2 hash: $argon2i$v=19$m=1024,t=2,p=2$YzJBSzV4TUhkMzc3d3laeg$zqU/1IN0/AogfP4cmSJI1vc8lpXRW9/S0sYY2i2jHT0

PHP Password Hashing Functions

❮ Func Math Abs Php Imagecolormatch ❯