Hashing with password_hash()

Learn secure password hashing with password_hash() and PASSWORD_DEFAULT.

What does password_hash do?

Storing passwords as plain text is a huge risk; if the database leaks, every account is exposed. The password_hash() function turns a password into a one-way string (hash); the original password cannot be recovered.

As the second argument you pass PASSWORD_DEFAULT. PHP maps this to the current recommended algorithm; today that is bcrypt. argon2 is also available as an alternative. The salt is added automatically; you do not need to generate it.

Why not md5 or sha1?

In old code you may see md5() or sha1(). They are fast, so they are weak against brute force; without a salt they can be broken with rainbow tables. Do not use them for password storage.

password_hash() uses cost-based algorithms instead. Each call generates a new salt embedded in the hash; the same password hashed twice yields different results.

Exercise Produce a hash with password_hash

Hash the $password variable with password_hash. Use PASSWORD_DEFAULT as the second argument. Print the length of the resulting hash with strlen.

Show example solution

Write $hash = password_hash($password, PASSWORD_DEFAULT);. Then print the length with echo strlen($hash) . "\n";.
Example solution:
<?php
$password = "gizli123";
$hash = password_hash($password, PASSWORD_DEFAULT);
echo strlen($hash) . "\n";

Test yourself

What does PASSWORD_DEFAULT do?
- It encrypts the password two-way
- It picks the current recommended algorithm
- It shortens the hash
- It saves the hash to the database
Show answer

It picks the current recommended algorithm — Correct. PASSWORD_DEFAULT maps to the current recommended algorithm (bcrypt).

Complete the password_hash call

$hash = ____($password, PASSWORD_DEFAULT);

Show answer

$hash = password_hash($password, PASSWORD_DEFAULT);

Match the password_hash concepts

password_hash

Hashes the password
PASSWORD_DEFAULT

Recommended algorithm
salt

Random salt
bcrypt

Cost-based algorithm

Next lesson: Verifying with password_verify()

We Are Enhancing Your Experience

Cookie Preferences

Strictly Necessary Cookies

Analytical Cookies