Password hashing with password_hash in PHP - Step-by-Step Execution

Concept Flow - Password hashing with password_hash

User inputs password

↓

Call password_hash()

↓

Generate secure hash

↓

Store hash safely

↓

Later: Verify with password_verify()

The flow shows how a password is taken, hashed securely, stored, and later verified.

Execution Sample

PHP

<?php
$password = 'mypassword';
$hash = password_hash($password, PASSWORD_DEFAULT);
echo $hash;
?>

This code takes a password, creates a secure hash, and prints the hash.

Execution Table

Step	Action	Input	Function Call	Output/Result
1	Set password variable	'mypassword'	None	$password = 'mypassword'
2	Call password_hash	$password = 'mypassword'	password_hash($password, PASSWORD_DEFAULT)	A hashed string (e.g. '$2y$10$...')
3	Print hash	Hashed string	echo $hash	Displays the hashed password string
4	End	N/A	N/A	Script ends

💡 Script ends after printing the hashed password string.

Variable Tracker

Variable	Start	After Step 1	After Step 2	Final
$password	undefined	'mypassword'	'mypassword'	'mypassword'
$hash	undefined	undefined	hashed string	hashed string

Key Moments - 3 Insights

Why does the output hash look like random characters?

The hash is a secure encrypted version of the password, not meant to be readable. See execution_table step 2 where password_hash creates this string.

Can we get the original password back from the hash?

No, hashing is one-way. You cannot reverse it. Instead, you verify passwords by comparing hashes using password_verify.

Why do we use PASSWORD_DEFAULT in password_hash?

PASSWORD_DEFAULT picks the best current algorithm automatically, making your code secure without manual updates.

Visual Quiz - 3 Questions

Look at the execution_table, what is stored in $hash after step 2?

A The original password 'mypassword'

B A hashed string like '$2y$10$...'

C An empty string

D A boolean true

💡 Hint

Check execution_table row 2 under Output/Result column.

At which step does the script print the hashed password?

A Step 3

B Step 2

C Step 1

D Step 4

💡 Hint

Look at execution_table row 3 where echo is called.

If you change PASSWORD_DEFAULT to PASSWORD_BCRYPT, what changes in the execution?

A The output is the original password

B The password variable changes

C The hash uses bcrypt algorithm explicitly

D The script will fail

💡 Hint

PASSWORD_BCRYPT is a specific algorithm option for password_hash.

Concept Snapshot

password_hash(password, algo) creates a secure hash of a password.
Use PASSWORD_DEFAULT for best current algorithm.
Hash is one-way; original password can't be recovered.
Store hash safely, verify with password_verify.
Never store plain passwords.

Full Transcript

This example shows how PHP's password_hash function takes a plain password and creates a secure hashed string. The password variable is set first, then password_hash is called with PASSWORD_DEFAULT to generate a hash. This hash looks like random characters and is printed. The hash cannot be reversed to get the original password. Instead, password_verify is used later to check passwords. Using PASSWORD_DEFAULT ensures the best algorithm is used automatically. This process keeps passwords safe by storing only hashes, not plain text.

Practice

1. What is the main purpose of the password_hash function in PHP?

easy

A. To store passwords in plain text

B. To verify if a password matches a hash

C. To decrypt a hashed password back to plain text

D. To securely convert a plain password into a hashed string

Solution

1. Step 1: Understand what password_hash does

   This function takes a plain password and creates a secure hashed version that cannot be reversed.

2. Step 2: Compare options with function purpose

   To securely convert a plain password into a hashed string correctly describes hashing. To verify if a password matches a hash is for password_verify. Options A and D are incorrect because passwords should never be stored in plain text or decrypted.

3. Final Answer:

   To securely convert a plain password into a hashed string -> Option D

4. Quick Check:

   password_hash = create secure hash [OK]

Hint: Hash means secure one-way password conversion [OK]

Common Mistakes:

• Confusing hashing with verifying passwords
• Thinking passwords can be decrypted
• Storing passwords as plain text

2. Which of the following is the correct syntax to hash a password using password_hash with the default algorithm?

easy

A. $hash = password_hash($password, PASSWORD_DEFAULT);

B. $hash = password_hash($password, 'default');

C. $hash = password_hash($password, default);

D. $hash = password_hash(PASSWORD_DEFAULT, $password);

Solution

1. Step 1: Recall the correct function signature

   The password_hash function requires the password string and the algorithm constant, e.g., PASSWORD_DEFAULT.

2. Step 2: Check each option's syntax

   $hash = password_hash($password, PASSWORD_DEFAULT); correctly passes the password variable and the constant. $hash = password_hash($password, 'default'); uses a string instead of constant. $hash = password_hash($password, default); uses undefined constant "default". $hash = password_hash(PASSWORD_DEFAULT, $password); swaps arguments incorrectly.

3. Final Answer:

   $hash = password_hash($password, PASSWORD_DEFAULT); -> Option A

4. Quick Check:

   password_hash(password, algorithm) correct syntax [OK]

Hint: Always pass password then algorithm constant [OK]

Common Mistakes:

• Using string 'default' instead of PASSWORD_DEFAULT
• Omitting the algorithm parameter
• Swapping argument order

3. What will be the output of the following PHP code?

$password = 'mypassword';
$hash = password_hash($password, PASSWORD_DEFAULT);
echo password_verify('mypassword', $hash) ? 'Valid' : 'Invalid';

medium

A. Invalid

B. Valid

C. Error: Undefined function

D. Empty output

Solution

1. Step 1: Understand password_hash and password_verify usage

   The code hashes 'mypassword' and then verifies the same password against the hash.

2. Step 2: Evaluate the verification result

   Since the password matches the hash, password_verify returns true, so 'Valid' is printed.

3. Final Answer:

   Valid -> Option B

4. Quick Check:

   password_verify correct password = true [OK]

Hint: Verify with same password returns true [OK]

Common Mistakes:

• Expecting hash to be plain text
• Confusing verify with hash
• Assuming password_verify returns the hash

4. Identify the error in this PHP code snippet:

$password = 'secret';
$hash = password_hash($password);
if (password_verify($hash, $password)) {
    echo 'Access granted';
} else {
    echo 'Access denied';
}

medium

A. Variable $password is undefined

B. Echo statements are incorrect

C. password_verify arguments are reversed

D. Missing algorithm parameter in password_hash

Solution

1. Step 1: Check password_verify function call

   The password_verify function takes the plain password as first argument and the hash as second. In the code, the arguments are reversed: hash first, then password.

2. Step 2: Verify other parts of the code

   The password_hash call is correct (uses PASSWORD_DEFAULT by default), $password is defined, echo statements are fine.

3. Final Answer:

   password_verify arguments are reversed -> Option C

4. Quick Check:

   password_verify(plain_password, hash) [OK]

Hint: password_verify(plain, hash) order [OK]

Common Mistakes:

• Forgetting the algorithm argument
• Swapping arguments in password_verify
• Assuming password_hash works with one argument

5. You want to store user passwords securely and later verify them during login. Which of the following code snippets correctly implements this using password_hash and password_verify?

hard

A. $hash = password_hash($userPassword, PASSWORD_DEFAULT);
// Store $hash in database

// Later during login
if (password_verify($inputPassword, $hash)) {
echo 'Login successful';
} else {
echo 'Login failed';
}

B. $hash = password_hash($userPassword);
// Store $hash

if (password_verify($hash, $inputPassword)) {
echo 'Login successful';
} else {
echo 'Login failed';
}

C. $hash = md5($userPassword);
// Store $hash

if (password_verify($inputPassword, $hash)) {
echo 'Login successful';
} else {
echo 'Login failed';
}

D. $hash = password_hash($userPassword, PASSWORD_DEFAULT);
// Store $userPassword

if (password_verify($inputPassword, $userPassword)) {
echo 'Login successful';
} else {
echo 'Login failed';
}

Solution

1. Step 1: Check correct usage of password_hash and password_verify

   $hash = password_hash($userPassword, PASSWORD_DEFAULT);
   // Store $hash in database
   
   // Later during login
   if (password_verify($inputPassword, $hash)) {
       echo 'Login successful';
   } else {
       echo 'Login failed';
   }

   hashes the password with PASSWORD_DEFAULT and stores the hash. Later, it verifies the input password against the stored hash correctly.

2. Step 2: Identify errors in other options

   $hash = password_hash($userPassword);
   // Store $hash
   
   if (password_verify($hash, $inputPassword)) {
       echo 'Login successful';
   } else {
       echo 'Login failed';
   }

   misses the algorithm and reverses arguments in password_verify.

   $hash = md5($userPassword);
   // Store $hash
   
   if (password_verify($inputPassword, $hash)) {
       echo 'Login successful';
   } else {
       echo 'Login failed';
   }

   uses insecure md5 instead of password_hash.

   $hash = password_hash($userPassword, PASSWORD_DEFAULT);
   // Store $userPassword
   
   if (password_verify($inputPassword, $userPassword)) {
       echo 'Login successful';
   } else {
       echo 'Login failed';
   }

   stores plain password and verifies incorrectly.

3. Final Answer:

   Option A correctly hashes and verifies passwords securely -> Option A

4. Quick Check:

   Hash with password_hash, verify with password_verify [OK]

Hint: Hash with PASSWORD_DEFAULT, verify with password_verify [OK]

Common Mistakes:

• Using md5 instead of password_hash
• Swapping arguments in password_verify
• Storing plain passwords instead of hashes