PHP reference

password_hash

Creates a password hash for storing in a database.

Syntax

password_hash(string $password, string|int|null $algo, array $options = []): string

Parameter	Type	Description
$password	string	The user's password.
$algo	string\|int\|null	The algorithm; pass `PASSWORD_DEFAULT`.
$options	array	Optional. The algorithm's settings.

stringA hash about 60 characters long.

The hash differs every time, even for the same password:

<?php
 
echo password_hash('secret', PASSWORD_DEFAULT);

Checking a password:

<?php
 
$hash = password_hash('secret', PASSWORD_DEFAULT);
 
var_dump(password_verify('secret', $hash));
var_dump(strlen($hash) >= 60);

Output:

bool(true)
bool(true)

Reserve a 255-character column for the hash: its length may grow when the algorithm changes. md5() and sha1() are unfit for passwords.

Security — The basics of PHP site security — XSS and escaping, SQL injection, password hashing, CSRF tokens and validating input.