Password Hashing in PHP

Never store plain passwords

The single most important rule of login security: never store a password as plain text. If your database is ever stolen, plain passwords are handed straight to the attacker. Instead you store a hash — a scrambled, one-way version — using PHP's built-in functions, which are both easy and very strong.

Hashing a password

When a user signs up, hash their password before saving it.

<?php
  $password = "mySecret123";
  $hash = password_hash($password, PASSWORD_DEFAULT);
  echo $hash;   // a long scrambled string
?>

password_hash uses a strong algorithm (bcrypt by default) and adds a random salt automatically. Save this hash in your users table — not the original password.

Verifying at login

At login, compare the entered password to the stored hash.

<?php
  $entered = "mySecret123";
  $storedHash = "$2y$10$Ku3...";   // from the database

  if (password_verify($entered, $storedHash)) {
      echo "Login success";
  } else {
      echo "Wrong password";
  }
?>

password_verify checks the entered password against the hash and returns true or false. You never decrypt the hash — you only verify against it.

Why hashing is safe

A hash is one-way: you can turn a password into a hash, but not a hash back into the password. So even if attackers steal your database, they only get scrambled hashes, not usable passwords. The automatic random salt also means two users with the same password get different hashes, defeating precomputed attack tables.

Keeping hashes up to date

<?php
  if (password_needs_rehash($storedHash, PASSWORD_DEFAULT)) {
      $newHash = password_hash($entered, PASSWORD_DEFAULT);
      // save $newHash to the database
  }
?>

As PHP improves its default algorithm, password_needs_rehash lets you upgrade old hashes automatically at the next successful login — keeping security current with no user effort.

Common mistakes

• Storing plain passwords. The classic, dangerous mistake — always hash.
• Using old functions like md5 or sha1. These are not safe for passwords; use password_hash.
• Trying to decrypt the hash. Hashes are one-way — verify with password_verify instead.
• Adding your own weak salt. Not needed — password_hash salts for you.

Summary

• Never store plain passwords — always store a hash.
• Hash with password_hash($pw, PASSWORD_DEFAULT).
• Check logins with password_verify($entered, $hash).
• Hashes are one-way and automatically salted — very safe.
• Use password_needs_rehash to keep hashes current.

Next, build the full flow in login and registration, or protect the database with prepared statements.