PHP's password_hash() function creates a secure, salted hash (using bcrypt or Argon2 by default) suitable for storing user passwords, and password_verify() checks a plaintext password against that hash. Passwords should never be stored in plaintext or with fast hashes like md5/sha1.
password_needs_rehash() lets applications detect when a stored hash uses an outdated algorithm or cost and should be regenerated after a successful login.