Hash Passwords Securely Using password_hash() in PHP

Store user passwords safely using modern hashing techniques in PHP for secure authentication systems.

🔐 Why Hash Passwords?

Plain text passwords are a major security risk. If your database is compromised, every user's credentials are exposed. PHP provides a modern, simple, and secure way to hash passwords using the password_hash() function.

🔑 How to Use password_hash()

The password_hash() function creates a secure hash using the bcrypt or Argon2 algorithm depending on PHP version and options.

<?php
$password = 'mySecurePassword123';
$hash = password_hash($password, PASSWORD_DEFAULT);
echo $hash;
?>

This generates a string like $2y$10$RANDOMSTRING... which includes salt and algorithm metadata.

✅ Verifying Passwords with password_verify()

Use password_verify() to safely compare a plain password with a hashed one from the database:

<?php
$entered = 'mySecurePassword123';
$storedHash = '$2y$10$ABC...'; // From DB

if (password_verify($entered, $storedHash)) {
  echo 'Password is valid!';
} else {
  echo 'Invalid credentials.';
}
?>

🔄 Should You Rehash Passwords?

If you update your algorithm (e.g., to use Argon2), use password_needs_rehash() to detect old hashes:

<?php
$options = ['cost' => 12];
if (password_needs_rehash($storedHash, PASSWORD_DEFAULT, $options)) {
  $newHash = password_hash($entered, PASSWORD_DEFAULT, $options);
  // Update DB
}
?>

💡 Best Practices

• Never store plain text passwords
• Always hash on registration and rehash on login if needed
• Use PASSWORD_DEFAULT unless you have specific requirements
• Enforce strong password policies (min length, symbols)

🧾 Summary

Use password_hash() to store passwords and password_verify() to validate them. Always rehash if your hashing strategy changes and avoid manual salting or custom hash functions , PHP does it all securely under the hood.