Password hashing with password_hash in PHP - Time & Space Complexity

Time Complexity: Password hashing with password_hash

O(r)

Understanding Time Complexity

When we use password_hash in PHP, it takes some time to turn a password into a secure hash.

We want to understand how the time it takes changes as the password or settings change.

Scenario Under Consideration

Analyze the time complexity of the following code snippet.

$password = 'mysecretpassword';
$hash = password_hash($password, PASSWORD_DEFAULT);
echo $hash;

This code creates a secure hash from a password using PHP's built-in function.

Identify Repeating Operations

Identify the loops, recursion, array traversals that repeat.

• Primary operation: The hashing algorithm runs multiple internal rounds to secure the password.
• How many times: The number of rounds depends on the algorithm and its cost setting, repeating the hashing steps many times.

How Execution Grows With Input

The time to hash grows mainly with the number of rounds, not the password length.

Input Size (Rounds)	Approx. Operations
10	10 hashing steps
20	20 hashing steps
50	50 hashing steps

Pattern observation: Doubling the rounds roughly doubles the time, while password length has little effect.

Final Time Complexity

Time Complexity: O(r)

This means the time grows linearly with the number of hashing rounds set in the algorithm.

Common Mistake

[X] Wrong: "Hashing time depends mostly on the password length."

[OK] Correct: The hashing time depends mainly on the number of rounds, not the password length, which is usually short and fixed.

Interview Connect

Understanding how hashing time grows helps you explain security trade-offs clearly and shows you know how to balance safety and performance.

Self-Check

"What if we increased the cost parameter in password_hash? How would the time complexity change?"

Practice

1. What is the main purpose of the password_hash function in PHP?

easy

A. To store passwords in plain text

B. To verify if a password matches a hash

C. To decrypt a hashed password back to plain text

D. To securely convert a plain password into a hashed string

Solution

1. Step 1: Understand what password_hash does

   This function takes a plain password and creates a secure hashed version that cannot be reversed.

2. Step 2: Compare options with function purpose

   To securely convert a plain password into a hashed string correctly describes hashing. To verify if a password matches a hash is for password_verify. Options A and D are incorrect because passwords should never be stored in plain text or decrypted.

3. Final Answer:

   To securely convert a plain password into a hashed string -> Option D

4. Quick Check:

   password_hash = create secure hash [OK]

Hint: Hash means secure one-way password conversion [OK]

Common Mistakes:

• Confusing hashing with verifying passwords
• Thinking passwords can be decrypted
• Storing passwords as plain text

2. Which of the following is the correct syntax to hash a password using password_hash with the default algorithm?

easy

A. $hash = password_hash($password, PASSWORD_DEFAULT);

B. $hash = password_hash($password, 'default');

C. $hash = password_hash($password, default);

D. $hash = password_hash(PASSWORD_DEFAULT, $password);

Solution

1. Step 1: Recall the correct function signature

   The password_hash function requires the password string and the algorithm constant, e.g., PASSWORD_DEFAULT.

2. Step 2: Check each option's syntax

   $hash = password_hash($password, PASSWORD_DEFAULT); correctly passes the password variable and the constant. $hash = password_hash($password, 'default'); uses a string instead of constant. $hash = password_hash($password, default); uses undefined constant "default". $hash = password_hash(PASSWORD_DEFAULT, $password); swaps arguments incorrectly.

3. Final Answer:

   $hash = password_hash($password, PASSWORD_DEFAULT); -> Option A

4. Quick Check:

   password_hash(password, algorithm) correct syntax [OK]

Hint: Always pass password then algorithm constant [OK]

Common Mistakes:

• Using string 'default' instead of PASSWORD_DEFAULT
• Omitting the algorithm parameter
• Swapping argument order

3. What will be the output of the following PHP code?

$password = 'mypassword';
$hash = password_hash($password, PASSWORD_DEFAULT);
echo password_verify('mypassword', $hash) ? 'Valid' : 'Invalid';

medium

A. Invalid

B. Valid

C. Error: Undefined function

D. Empty output

Solution

1. Step 1: Understand password_hash and password_verify usage

   The code hashes 'mypassword' and then verifies the same password against the hash.

2. Step 2: Evaluate the verification result

   Since the password matches the hash, password_verify returns true, so 'Valid' is printed.

3. Final Answer:

   Valid -> Option B

4. Quick Check:

   password_verify correct password = true [OK]

Hint: Verify with same password returns true [OK]

Common Mistakes:

• Expecting hash to be plain text
• Confusing verify with hash
• Assuming password_verify returns the hash

4. Identify the error in this PHP code snippet:

$password = 'secret';
$hash = password_hash($password);
if (password_verify($hash, $password)) {
    echo 'Access granted';
} else {
    echo 'Access denied';
}

medium

A. Variable $password is undefined

B. Echo statements are incorrect

C. password_verify arguments are reversed

D. Missing algorithm parameter in password_hash

Solution

1. Step 1: Check password_verify function call

   The password_verify function takes the plain password as first argument and the hash as second. In the code, the arguments are reversed: hash first, then password.

2. Step 2: Verify other parts of the code

   The password_hash call is correct (uses PASSWORD_DEFAULT by default), $password is defined, echo statements are fine.

3. Final Answer:

   password_verify arguments are reversed -> Option C

4. Quick Check:

   password_verify(plain_password, hash) [OK]

Hint: password_verify(plain, hash) order [OK]

Common Mistakes:

• Forgetting the algorithm argument
• Swapping arguments in password_verify
• Assuming password_hash works with one argument

5. You want to store user passwords securely and later verify them during login. Which of the following code snippets correctly implements this using password_hash and password_verify?

hard

A. $hash = password_hash($userPassword, PASSWORD_DEFAULT);
// Store $hash in database

// Later during login
if (password_verify($inputPassword, $hash)) {
echo 'Login successful';
} else {
echo 'Login failed';
}

B. $hash = password_hash($userPassword);
// Store $hash

if (password_verify($hash, $inputPassword)) {
echo 'Login successful';
} else {
echo 'Login failed';
}

C. $hash = md5($userPassword);
// Store $hash

if (password_verify($inputPassword, $hash)) {
echo 'Login successful';
} else {
echo 'Login failed';
}

D. $hash = password_hash($userPassword, PASSWORD_DEFAULT);
// Store $userPassword

if (password_verify($inputPassword, $userPassword)) {
echo 'Login successful';
} else {
echo 'Login failed';
}

Solution

1. Step 1: Check correct usage of password_hash and password_verify

   $hash = password_hash($userPassword, PASSWORD_DEFAULT);
   // Store $hash in database
   
   // Later during login
   if (password_verify($inputPassword, $hash)) {
       echo 'Login successful';
   } else {
       echo 'Login failed';
   }

   hashes the password with PASSWORD_DEFAULT and stores the hash. Later, it verifies the input password against the stored hash correctly.

2. Step 2: Identify errors in other options

   $hash = password_hash($userPassword);
   // Store $hash
   
   if (password_verify($hash, $inputPassword)) {
       echo 'Login successful';
   } else {
       echo 'Login failed';
   }

   misses the algorithm and reverses arguments in password_verify.

   $hash = md5($userPassword);
   // Store $hash
   
   if (password_verify($inputPassword, $hash)) {
       echo 'Login successful';
   } else {
       echo 'Login failed';
   }

   uses insecure md5 instead of password_hash.

   $hash = password_hash($userPassword, PASSWORD_DEFAULT);
   // Store $userPassword
   
   if (password_verify($inputPassword, $userPassword)) {
       echo 'Login successful';
   } else {
       echo 'Login failed';
   }

   stores plain password and verifies incorrectly.

3. Final Answer:

   Option A correctly hashes and verifies passwords securely -> Option A

4. Quick Check:

   Hash with password_hash, verify with password_verify [OK]

Hint: Hash with PASSWORD_DEFAULT, verify with password_verify [OK]

Common Mistakes:

• Using md5 instead of password_hash
• Swapping arguments in password_verify
• Storing plain passwords instead of hashes