Password hashing with password_hash in PHP - Step-by-Step Execution

Concept Flow - Password hashing with password_hash

User inputs password

↓

Call password_hash()

↓

Generate secure hash

↓

Store hash safely

↓

Later: Verify with password_verify()

The flow shows how a password is taken, hashed securely, stored, and later verified.

Execution Sample

PHP

<?php
$password = 'mypassword';
$hash = password_hash($password, PASSWORD_DEFAULT);
echo $hash;
?>

This code takes a password, creates a secure hash, and prints the hash.

Execution Table

Step	Action	Input	Function Call	Output/Result
1	Set password variable	'mypassword'	None	$password = 'mypassword'
2	Call password_hash	$password = 'mypassword'	password_hash($password, PASSWORD_DEFAULT)	A hashed string (e.g. '$2y$10$...')
3	Print hash	Hashed string	echo $hash	Displays the hashed password string
4	End	N/A	N/A	Script ends

💡 Script ends after printing the hashed password string.

Variable Tracker

Variable	Start	After Step 1	After Step 2	Final
$password	undefined	'mypassword'	'mypassword'	'mypassword'
$hash	undefined	undefined	hashed string	hashed string

Key Moments - 3 Insights

Why does the output hash look like random characters?

The hash is a secure encrypted version of the password, not meant to be readable. See execution_table step 2 where password_hash creates this string.

Can we get the original password back from the hash?

No, hashing is one-way. You cannot reverse it. Instead, you verify passwords by comparing hashes using password_verify.

Why do we use PASSWORD_DEFAULT in password_hash?

PASSWORD_DEFAULT picks the best current algorithm automatically, making your code secure without manual updates.

Visual Quiz - 3 Questions

Look at the execution_table, what is stored in $hash after step 2?

A The original password 'mypassword'

B A hashed string like '$2y$10$...'

C An empty string

D A boolean true

💡 Hint

Check execution_table row 2 under Output/Result column.

At which step does the script print the hashed password?

A Step 3

B Step 2

C Step 1

D Step 4

💡 Hint

Look at execution_table row 3 where echo is called.

If you change PASSWORD_DEFAULT to PASSWORD_BCRYPT, what changes in the execution?

A The output is the original password

B The password variable changes

C The hash uses bcrypt algorithm explicitly

D The script will fail

💡 Hint

PASSWORD_BCRYPT is a specific algorithm option for password_hash.

Concept Snapshot

password_hash(password, algo) creates a secure hash of a password.
Use PASSWORD_DEFAULT for best current algorithm.
Hash is one-way; original password can't be recovered.
Store hash safely, verify with password_verify.
Never store plain passwords.

Full Transcript

This example shows how PHP's password_hash function takes a plain password and creates a secure hashed string. The password variable is set first, then password_hash is called with PASSWORD_DEFAULT to generate a hash. This hash looks like random characters and is printed. The hash cannot be reversed to get the original password. Instead, password_verify is used later to check passwords. Using PASSWORD_DEFAULT ensures the best algorithm is used automatically. This process keeps passwords safe by storing only hashes, not plain text.