password_hash returns different value every time

php hash passwords php-password-hash
ItzBenteThePig picture ItzBenteThePig · Oct 13, 2015 · Viewed 12.9k times · Source

I'm making a login system, and I want to hash the passwords to make them more secure, but it returns a different hash every time, and can't even be verified using password_verify(), here is my code:

$password = password_hash($password4, PASSWORD_DEFAULT);

and here is my code for verifying:

if(password_verify($password4, $dbpassword))

Answer

Machavity picture Machavity · Oct 13, 2015

So let's take it one part at a time

but it returns a different hash every time

That's the idea. password_hash is designed to generate a random salt every time. This means you have to break each hash individually instead of guessing one salt used for everything and having a huge leg up.

There's no need to MD5 or do any other hashing. If you want to raise the security of password_hash you pass a higher cost (default cost is 10)

$password = password_hash($password4, PASSWORD_DEFAULT, ['cost' => 15]);

As to verify

if(password_verify($password4, $dbpassword))

So $password4 should be your unhashed password and $dbpassword should be the hash you've stored in your database

Related questions

Using PHP 5.5's password_hash and password_verify function

Say I wanted to store a password for a user, would this be the right way to do it with PHP 5.5's password_hash() function (or this version for PHP 5.3.7+: https://github.com/ircmaxell/password_compat)? $options = array("cost" => 10, "…

Read More
Verifying MD5 passwords using password_verify()

Is there a way to convert a MD5 password to something that can be verified by password_verify()? I read on the Crypt Wikipedia page that "The printable form of MD5 password hashes starts with $1$." Hence I give this a …

Read More
How to create wordpress password hash generator using php?

I want to create WordPress password hash using PHP like www.passwordtool.hu. An example: Password: admin321 Wordpress Password Hash: $1$8HmCMIeg$qv9z585yftJa2Hxqo7/RB/ For testing purpose here is the tool Online Password Generator Tool: http://www.passwordtool.…

Read More