Password Hashing in PHP: password_hash() Done Right

If your PHP application still uses md5() or plain SHA-256 for passwords, this is worth fixing today — those algorithms are fast by design, which is exactly the wrong property for password hashing.

// Hashing a password (bcrypt by default, auto-generates a salt)
$hash = password_hash($plainPassword, PASSWORD_DEFAULT);

// Verifying a login attempt
if (password_verify($submittedPassword, $hash)) {
    // login successful
}

// Check if the hash needs upgrading (e.g. after raising the cost factor)
if (password_needs_rehash($hash, PASSWORD_DEFAULT)) {
    $newHash = password_hash($plainPassword, PASSWORD_DEFAULT);
    // save $newHash to the database
}

password_hash() uses bcrypt (or Argon2 if you specify it) — algorithms deliberately designed to be slow, making brute-force attacks against stolen hashes impractical. There’s no legitimate reason to roll your own password hashing in PHP anymore.