password_hash

Description

password_hash() creates a new password hash using a strong one-way hashing algorithm.

The following algorithms are currently supported:

• PASSWORD_DEFAULT - Use the bcrypt algorithm (default as of PHP 5.5.0). Note that this constant is designed to change over time as new and stronger algorithms are added to PHP. For that reason, the length of the result from using this identifier can change over time. Therefore, it is recommended to store the result in a database column that can expand beyond 60 bytes (255 bytes would be a good choice).

• PASSWORD_BCRYPT - Use the bcrypt algorithm to create the hash. This will produce a standard crypt() compatible hash using the $2y$ identifier.

• PASSWORD_ARGON2I - Use the Argon2i hashing algorithm to create the hash. This algorithm is only available if PHP has been compiled with Argon2 support.

• PASSWORD_ARGON2ID - Use the Argon2id hashing algorithm to create the hash. This algorithm is only available if PHP has been compiled with Argon2 support.

Supported options for PASSWORD_BCRYPT:

• salt (string) - to manually provide a salt to use when hashing the password. Note that this will override and prevent a salt from being automatically generated.

  If omitted, a random salt will be generated by password_hash() for each password hashed. This is the intended mode of operation.

  Warning

  The salt option is deprecated. It is now preferred to simply use the salt that is generated by default. As of PHP 8.0.0, an explicitly given salt is ignored.

• cost (int) - which denotes the algorithmic cost that should be used. Examples of these values can be found on the crypt() page.

  If omitted, a default value of 12 will be used. This is a good baseline cost, but it should be adjusted depending on hardware used.

Supported options for PASSWORD_ARGON2I and PASSWORD_ARGON2ID:

• memory_cost (int) - Maximum memory (in kibibytes) that may be used to compute the Argon2 hash. Defaults to PASSWORD_ARGON2_DEFAULT_MEMORY_COST.

• time_cost (int) - Number of iterations (passes) used to compute the Argon2 hash. Defaults to PASSWORD_ARGON2_DEFAULT_TIME_COST.

• threads (int) - Number of threads to use for computing the Argon2 hash. Defaults to PASSWORD_ARGON2_DEFAULT_THREADS.

  Warning

  Only available when PHP uses libargon2, not with libsodium implementation.

<?php
echo password_hash("rasmuslerdorf", PASSWORD_DEFAULT);
?>

$2y$12$4Umg0rCJwMswRw/l.SwHvuQV01coP0eWmGzd61QH2RvAOMANUBGC.

<?php
$options = [
    // Increase the bcrypt cost from 12 to 13.
    'cost' => 13,
];
echo password_hash("rasmuslerdorf", PASSWORD_BCRYPT, $options);
?>

$2y$13$xeDfQumlmdm0Sco.4qmH1OGfUUmOcuRmfae0dPJhjX1Bq0yYhqbNi

<?php
$timeTarget = 0.350; // 350 milliseconds

$cost = 11;
do {
    $cost++;
    $start = microtime(true);
    password_hash("test", PASSWORD_BCRYPT, ["cost" => $cost]);
    $end = microtime(true);
} while (($end - $start) < $timeTarget);

echo "Appropriate Cost Found: " . $cost - 1;
?>

Appropriate Cost Found: 13

<?php
echo 'Argon2i hash: ' . password_hash('rasmuslerdorf', PASSWORD_ARGON2I);
?>

Argon2i hash: $argon2i$v=19$m=1024,t=2,p=2$YzJBSzV4TUhkMzc3d3laeg$zqU/1IN0/AogfP4cmSJI1vc8lpXRW9/S0sYY2i2jHT0