Password Hashing and Verification in PHP

When Handling passwords securely in PHP the recommended approach is to use hashing. Instead of encrypting passwords, it is better to hash them because hashing is a one-way process, which means it can not be reversed. This makes it more secure.

Encryption on the other hand can be useful when you need to decrypt data. For this reason, hashing is the safer and preferred method for password storage in PHP. This uses the PHP Password API available in version 5.5.0 and above.

How to Hash a Password in PHP

To generate a hash from the string, we use the password_hash() function. This function uses strong hashing algorithms such as bcrypt and argon2 to securely generate a password hash.

Syntax:

string password_hash(string $password, 
          mixed $algo, [array $options])

• The password_hash() function creates a new password hash of the string using one of the available hashing algorithm.
• It returns the hash that is currently 60 character long, however, as new and stronger algorithms will be added to PHP, the length of the hash may increase.
• It is therefore recommended to allocate 255 characters for the column that may be used to store the hash in database.

The following algorithms are currently supported when using this function:

• PASSWORD_DEFAULT
• PASSWORD_BCRYPT
• PASSWORD_ARGON2I
• PASSWORD_ARGON2ID

Example: The below example shows the method of using the password_hash() method:

<?php

  // The plain text password to be hashed
  $plaintext_password = "Password@123";

  // The hash of the password that
  // can be stored in the database
  $hash = password_hash($plaintext_password, 
          PASSWORD_DEFAULT);

  // Print the generated hash
  echo "Generated hash: ".$hash;
?>

Output:

Generated hash: $2y$10$7rLSvRVyTQORapkDOqmkhetjF6H9lJHngr4hJMSM2lHObJbW5EQh6

How to Verify a Password

Once a password is hashed and stored, you cannot retrieve the original password. To decrypt a password hash and retrieve the original string, we use the password_verify() function. This function checks if the provided plaintext password matches the stored hashed password.

Syntax:

bool password_verify(string $password, string $hash)

The password_verify() function verifies that the given hash matches the given password, generated by the password_hash() function. It returns true if the password and hash match, or false otherwise.

Example: The below example shows how to verify a user's password against the stored hash:

<?php

  // Plaintext password entered by the user
  $plaintext_password = "Password@123";

  // The hashed password retrieved from database
  $hash = 
"$2y$10$8sA2N5Sx/1zMQv2yrTDAaOFlbGWECrrgB68axL.hBb78NhQdyAqWm";

  // Verify the hash against the password entered
  $verify = password_verify($plaintext_password, $hash);

  // Print the result depending if they match
  if ($verify) {
      echo 'Password Verified!';
  } else {
      echo 'Incorrect Password!';
  }
?>

Output:

Password Verified!

Important to Remember

• Choosing the Right Algorithm: Use PASSWORD_DEFAULT (bcrypt) for balanced security and performance. Consider argon2 for stronger security in newer PHP versions.
• Storing the Hash: Allocate atleast 255 characters in your database to store password hashes because hash length may vary with different algorithms.
• Salting: password_hash() automatically generates and includes the salt in the hash, so no need for manual salting.

Conclusion

When dealing with passwords in PHP we use password_hash() function to ensure that passwords are stored securely and correctly. Always verify passwords with password_verify() to authenticate users while maintaining security. Never store plaintext passwords, try to always hash them.