crypt returns a legacy password-hash format selected by the supplied salt prefix; new applications should prefer password_hash.
The examples explain the data format, expected results and the difference between this API and nearby cryptographic operations.
What It Does
The operation is intended for: crypt returns a legacy password-hash format selected by the supplied salt prefix; new applications should prefer password_hash.
Part of core PHP or a normally bundled standard extension; check your deployment configuration.
Syntax and Return Value
crypt(string $string, string $salt): string| Parameter | Purpose |
|---|---|
| $string (string) | Use the PHP signature above to determine the exact expected input type; validate untrusted inputs before calling. |
| $salt (string) | A salt with the exact required length; use random_bytes for password-derived keys. |
The declared return type is shown above. Errors can include false results or exceptions depending on this API: Never store plaintext passwords or compare password hashes with ==; salts and hash algorithm metadata belong in the stored hash.
Example 1: Basic Operation
Inspect the expected result: do not print secrets or reuse illustrative credentials in production.
<?php
$stored = crypt("demo-password", "\$2y\$10\$abcdefghijklmnopqrstuv");
var_dump(password_verify("demo-password", $stored));Example 2: A Different Use Case
Compare a wrong password and inspect the legacy bcrypt hash format.
<?php
$hash = crypt('demo-password', '$2y$10$abcdefghijklmnopqrstuv');
var_dump(password_verify('incorrect', $hash) === false);Practical Example: Checking the Result
Compare a wrong password and inspect the legacy bcrypt hash format.
<?php
$hash = crypt('demo-password', '$2y$10$abcdefghijklmnopqrstuv');
var_dump(password_get_info($hash)['algoName']);Important Behavior and Edge Cases
Never store plaintext passwords or compare password hashes with ==; salts and hash algorithm metadata belong in the stored hash.
Password storage requires purpose-built salted, slow hashes; a fast cryptographic digest must never be used as a substitute.
Comparison with Related Functions
| Approach | Key distinction |
|---|---|
| crypt | crypt returns a legacy password-hash format selected by the supplied salt prefix; new applications should prefer password_hash. |
| Related technique | password_hash and password_verify are the preferred pair for new PHP password authentication. |
Common Beginner Mistakes
| Mistake | Correct approach |
|---|---|
| Confusing this operation with a neighboring cryptographic or security mechanism | password_hash and password_verify are the preferred pair for new PHP password authentication. |
| Ignoring a security prerequisite or failure case | Never store plaintext passwords or compare password hashes with ==; salts and hash algorithm metadata belong in the stored hash. |
Key Takeaways
- crypt returns a legacy password-hash format selected by the supplied salt prefix; new applications should prefer password_hash.
- Never store plaintext passwords or compare password hashes with ==; salts and hash algorithm metadata belong in the stored hash.
- password_hash and password_verify are the preferred pair for new PHP password authentication.
Apply this behavior to a real application only after confirming the required extension, configuration and failure handling on the deployment runtime.