0Pricing
PHP Academy · Lesson

Secure Password Storage

Hash passwords with password_hash and verify with password_verify.

Secure Password Storage is a free PHP Academy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the PHP Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Never Store Plaintext Passwords

Storing passwords in plaintext means a database breach exposes every user's password. Always store a cryptographic hash — ideally bcrypt, Argon2id, or scrypt.

password_hash()

PHP's built-in password_hash() creates a secure hash with a random salt included in the output.

<?php
$hash = password_hash("mysecretpassword", PASSWORD_BCRYPT);
// Output: $2y$10$... (includes algorithm, cost, salt, hash)

password_verify()

Verify a plaintext password against a stored hash.

<?php
$hash  = "$2y$10$abcdef...";
$valid = password_verify("mysecretpassword", $hash);
if ($valid) {
    echo "Correct password!";
}

Algorithm Options

PHP supports:

  • PASSWORD_BCRYPT — widely supported, 72-byte limit
  • PASSWORD_ARGON2I — memory-hard (PHP 7.2+)
  • PASSWORD_ARGON2ID — recommended, resists GPU attacks (PHP 7.3+)
  • PASSWORD_DEFAULT — currently bcrypt, may change in future PHP versions

Cost Factor

The cost factor controls how slow the hash computation is. Higher cost = slower brute-force attacks. Default bcrypt cost is 10.

<?php
$hash = password_hash("secret", PASSWORD_BCRYPT, ["cost" => 12]);
// Cost 12 takes ~0.5s on typical hardware — acceptable for login

password_needs_rehash()

After upgrading PHP or changing cost settings, check if existing hashes need to be upgraded.

<?php
if (password_verify($plain, $storedHash) &&
    password_needs_rehash($storedHash, PASSWORD_DEFAULT)) {
    $user->update(["password" => password_hash($plain, PASSWORD_DEFAULT)]);
}

Laravel's Hash Facade

Laravel wraps password_hash in the Hash facade, defaulting to bcrypt.

<?php
use Illuminate\Support\Facades\Hash;

$hash  = Hash::make("mysecretpassword");
$valid = Hash::check("mysecretpassword", $hash); // true

Argon2 in Laravel

Configure Laravel to use Argon2id in config/hashing.php.

// config/hashing.php
"driver" => "argon2id",

Salt Handling

Modern PHP hashing functions include a cryptographically random salt automatically. Never implement your own salting — it is easy to do it wrong.

Pepper (Application-Level Secret)

An optional additional secret (pepper) stored outside the database can be mixed in before hashing. Even if the DB is stolen, the attacker cannot brute-force without the pepper.

Timing-Safe Comparison

password_verify() uses constant-time comparison internally, preventing timing attacks. Never compare hashes with ==.

Summary

Use password_hash() with PASSWORD_DEFAULT or PASSWORD_ARGON2ID. Verify with password_verify(). Rehash on login if needed. Never store plaintext or use MD5/SHA1 for passwords.

Quick Check

Which function verifies a password against a PHP-generated hash?

Frequently asked questions

Is the “Secure Password Storage” lesson free?

Yes — the full text of “Secure Password Storage” is free to read here on the web, and the PHP Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the PHP Academy course, upgrade to CoddyKit PRO.

What will I learn in “Secure Password Storage”?

Hash passwords with password_hash and verify with password_verify. You practise PHP Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start PHP Academy?

No prior experience is required. PHP Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Secure Password Storage” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this PHP Academy lesson?

Yes. Every PHP Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Cross-Site Scripting (XSS) Prevention
  2. SQL Injection and Parameterized Queries
  3. CSRF Protection
  4. Secure Password Storage
← Back to PHP Academy