password_verify checks a candidate plaintext password against a previously stored password_hash-compatible hash.
The examples explain the data format, expected results and the difference between this API and nearby cryptographic operations.
What It Does
The operation is intended for: password_verify checks a candidate plaintext password against a previously stored password_hash-compatible hash.
Part of core PHP or a normally bundled standard extension; check your deployment configuration.
Syntax and Return Value
password_verify(string $password, string $hash): bool| Parameter | Purpose |
|---|---|
| $password (string) | Secret password input. Never print or log a live password. |
| $hash (string) | Previously stored hash or digest to inspect or compare. |
The declared return type is shown above. Errors can include false results or exceptions depending on this API: Never store plaintext passwords or compare password hashes with ==; salts and hash algorithm metadata belong in the stored hash.
Example 1: Basic Operation
Inspect the expected result: do not print secrets or reuse illustrative credentials in production.
<?php
$hash = password_hash("demo-password", PASSWORD_DEFAULT);
var_dump(password_verify("demo-password", $hash));Example 2: A Different Use Case
Distinguish failed verification from successful verification without manually hashing the candidate.
<?php
$stored = password_hash('expected', PASSWORD_DEFAULT);
var_dump(password_verify('wrong', $stored) === false);Practical Example: Checking the Result
Distinguish failed verification from successful verification without manually hashing the candidate.
<?php
$stored = password_hash('expected', PASSWORD_DEFAULT);
var_dump(password_verify('expected', $stored));Important Behavior and Edge Cases
Never store plaintext passwords or compare password hashes with ==; salts and hash algorithm metadata belong in the stored hash.
Password storage requires purpose-built salted, slow hashes; a fast cryptographic digest must never be used as a substitute.
Comparison with Related Functions
| Approach | Key distinction |
|---|---|
| password_verify | password_verify checks a candidate plaintext password against a previously stored password_hash-compatible hash. |
| Related technique | password_hash and password_verify are the preferred pair for new PHP password authentication. |
Common Beginner Mistakes
| Mistake | Correct approach |
|---|---|
| Confusing this operation with a neighboring cryptographic or security mechanism | password_hash and password_verify are the preferred pair for new PHP password authentication. |
| Ignoring a security prerequisite or failure case | Never store plaintext passwords or compare password hashes with ==; salts and hash algorithm metadata belong in the stored hash. |
Key Takeaways
- password_verify checks a candidate plaintext password against a previously stored password_hash-compatible hash.
- Never store plaintext passwords or compare password hashes with ==; salts and hash algorithm metadata belong in the stored hash.
- password_hash and password_verify are the preferred pair for new PHP password authentication.
Apply this behavior to a real application only after confirming the required extension, configuration and failure handling on the deployment runtime.