Password Hashing PHP 7

php password-encryption password-hash
IMO picture IMO · Feb 8, 2017 · Viewed 13.7k times · Source

I am currently learning PHP and I have been looking through the forum for current thinking on how best to Hash passwords in PHP.

Can anyone advise on what is currently the best password hashing method to use. I have been told about PHPass, but are there better alternatives in 2017?

Thank you for any advice,

Ian

Answer

Jay Blanchard picture Jay Blanchard · Feb 8, 2017

You should never encrypt passwords, you should only hash them. Encryption implies that you can decrypt the password into a human readable form. You should never do that. Hashing is a one way street and once hashed a password cannot be recovered in human readable form.

Please use PHP's built-in functions password_hash() and password_verify()to handle password security. If you're using a PHP version less than 5.5 you can use the password_hash() compatibility pack. Make sure you don't escape passwords or use any other cleansing mechanism on them before hashing. Doing so changes the password and causes unnecessary additional coding.

Related questions

Call to undefined function password_hash()

I am running php version 5.4.16 on localhost right now, while I am developing my site. I want to use password_hash(), but I keep getting this error: Fatal error: Call to undefined function password_hash() in /dir/to/file.php …

Read More
Best way encrypt password php (in 2017)

In my website I use md5 to crypt password user in my database (and store session user) $pswUser = md5($_POST["password"]); But I have just been told that this way of encrypting has become obsolete I did some research to …

Read More
Decode hash sha256 encryption, knowing the salt

I'm making a login system for a web application. To store passwords in the DB, I'm encrypting passwords using sha256 as follows: $salt ="sometext"; $escapedPW="userpass"; $saltedPW = $escapedPW . $salt; $hashedPW = hash('sha256', $saltedPW); echo "<center>".$hashedPW."</…

Read More