How to Securely Hash Passwords in PHP

PHP's built-in password_hash() function generates a secure, salted hash of a password using bcrypt (or Argon2), and password_verify() checks a plain-text password against that hash.

$hash = password_hash($plainPassword, PASSWORD_DEFAULT);
// store $hash in the database

if (password_verify($inputPassword, $hash)) {
    // password is correct
}

Steps

1. Call password_hash($password, PASSWORD_DEFAULT) when a user registers or changes their password, and store only the resulting hash
2. Never store the plain-text password anywhere, even temporarily in logs
3. When a user logs in, call password_verify($input, $storedHash) to check the password without ever decrypting anything — hashing is one-way

How it works

password_hash() automatically generates a random salt and embeds it in the output string, so identical passwords produce different hashes each time — this defeats precomputed rainbow-table attacks.

Things to watch for

• Never use md5() or sha1() for passwords — they're fast general-purpose hashes designed for speed, which makes them easy to brute-force; password_hash() is deliberately slow
• PASSWORD_DEFAULT automatically upgrades to a stronger algorithm as PHP evolves — use password_needs_rehash() to detect and re-hash old passwords on next login

FAQ

Can I reverse password_hash() to get the original password?

No — it's a one-way cryptographic hash by design. The only way to check a password is password_verify(), which re-hashes the input and compares.