password_hash creates a randomized salted password hash that stores algorithm metadata needed for later verification.
The examples explain the data format, expected results and the difference between this API and nearby cryptographic operations.
What It Does
The operation is intended for: password_hash creates a randomized salted password hash that stores algorithm metadata needed for later verification.
Part of core PHP or a normally bundled standard extension; check your deployment configuration.
Syntax and Return Value
password_hash(string $password, string|int|null $algo, array $options = ...): string| Parameter | Purpose |
|---|---|
| $password (string) | Secret password input. Never print or log a live password. |
| $algo (string|int|null) | The exact algorithm identifier supported by this API. |
| $options (array) | Driver or algorithm-specific options; avoid unchecked user-controlled settings. |
The declared return type is shown above. Errors can include false results or exceptions depending on this API: Never store plaintext passwords or compare password hashes with ==; salts and hash algorithm metadata belong in the stored hash.
Example 1: Basic Operation
Inspect the expected result: do not print secrets or reuse illustrative credentials in production.
<?php
$hash = password_hash("demo-password", PASSWORD_DEFAULT);
var_dump(password_verify("demo-password", $hash));Example 2: A Different Use Case
Reject a wrong candidate, and show why randomly salted hashes of the same password differ.
<?php
$hash = password_hash('example-password', PASSWORD_DEFAULT);
var_dump(password_verify('wrong-password', $hash) === false);Practical Example: Checking the Result
Reject a wrong candidate, and show why randomly salted hashes of the same password differ.
<?php
$first = password_hash('same-password', PASSWORD_DEFAULT);
$second = password_hash('same-password', PASSWORD_DEFAULT);
var_dump($first !== $second);Important Behavior and Edge Cases
Never store plaintext passwords or compare password hashes with ==; salts and hash algorithm metadata belong in the stored hash.
Password storage requires purpose-built salted, slow hashes; a fast cryptographic digest must never be used as a substitute.
Comparison with Related Functions
| Approach | Key distinction |
|---|---|
| password_hash | password_hash creates a randomized salted password hash that stores algorithm metadata needed for later verification. |
| Related technique | password_hash and password_verify are the preferred pair for new PHP password authentication. |
Common Beginner Mistakes
| Mistake | Correct approach |
|---|---|
| Confusing this operation with a neighboring cryptographic or security mechanism | password_hash and password_verify are the preferred pair for new PHP password authentication. |
| Ignoring a security prerequisite or failure case | Never store plaintext passwords or compare password hashes with ==; salts and hash algorithm metadata belong in the stored hash. |
Key Takeaways
- password_hash creates a randomized salted password hash that stores algorithm metadata needed for later verification.
- Never store plaintext passwords or compare password hashes with ==; salts and hash algorithm metadata belong in the stored hash.
- password_hash and password_verify are the preferred pair for new PHP password authentication.
Apply this behavior to a real application only after confirming the required extension, configuration and failure handling on the deployment runtime.