PHP theorytheory 0/50 · 0%
Security · medium

29. Password Hashing

Storing credentials safely.

PHP's password_hash() function creates a secure, salted hash (using bcrypt or Argon2 by default) suitable for storing user passwords, and password_verify() checks a plaintext password against that hash. Passwords should never be stored in plaintext or with fast hashes like md5/sha1.

password_needs_rehash() lets applications detect when a stored hash uses an outdated algorithm or cost and should be regenerated after a successful login.

Check your understanding

  1. 1. Which function verifies a plaintext password against a stored hash?

  2. 2. Why avoid md5() for password storage?