password_hash()

password_hash() — Creates a password hash.

Built-in function of PHP 8.5. The manual lists it as available in PHP 5 >= 5.5.0, PHP 7, PHP 8. This page is the reference card: signature, parameters and return value, plus the changelog and the example the manual provides.

What it does

password_hash() creates a new password hash using a strong one-way hashing algorithm.

Signature

password_hash(string $password, string|int|null $algo, array $options = []): string

Parameters

ParameterTypeWhat it takes
$passwordstringThe user's password.
$algostring|int|nullA password algorithm constant denoting the algorithm to use when hashing the password.
$optionsarrayAn associative array containing options. See the password algorithm constants for documentation on the supported options for each algorithm.

Return value

Returns the hashed password. The used algorithm, cost and salt are returned as part of the hash. Therefore, all information that's needed to verify the hash is included in it. This allows the password_verify() function to verify the hash without needing separate storage for the salt or algorithm information.

Example

A runnable snippet:

echo password_hash("rasmuslerdorf", PASSWORD_DEFAULT);

Output:

$2y$12$4Umg0rCJwMswRw/l.SwHvuQV01coP0eWmGzd61QH2RvAOMANUBGC.

Changelog

VersionChange
8.4.0The default value of the cost option of the PASSWORD_BCRYPT algorithm was increased from 10 to 12.
8.3.0password_hash() now sets the underlying Random\RandomException as the Exception::$previous exception when a ValueError is thrown due to a failure in the salt generation.
8.0.0password_hash() no longer returns false on failure, instead a ValueError will be thrown if the password hashing algorithm is not valid, or an Error if the password hashing failed for an unknown error.
8.0.0The algo parameter is nullable now.
7.4.0The algo parameter expects a string now, but still accepts ints for backward compatibility.
7.4.0The sodium extension provides an alternative implementation for Argon2 passwords.

See also

password_verify(), password_needs_rehash(), crypt()

All PHP 8.5 built-in functions

Reference card built from the PHP manual page password_hash() (PHP documentation, CC BY 3.0). The page is generated from the manual, so the wording of the parameter and return value text follows php.net.