Password Security
Never store plain-text or MD5/SHA1 passwords. Use password_hash() with PASSWORD_DEFAULT (bcrypt or argon2) and verify with password_verify().
PHP
Beginner
4 min read
Password Hashing
Example
// Hash on registration
$hash = password_hash($rawPassword, PASSWORD_DEFAULT);
// Store $hash in database
// Verify on login
$user = getUserByEmail($email);
if (password_verify($rawPassword, $user["password_hash"])) {
// Login success — check for rehash
if (password_needs_rehash($user["password_hash"], PASSWORD_DEFAULT)) {
updatePasswordHash($user["id"], password_hash($rawPassword, PASSWORD_DEFAULT));
}
} Pro Tip
PASSWORD_DEFAULT updates to stronger algorithms in new PHP versions — rehash on login to upgrade old hashes.