Authentication · Lesson 3 of 7

Password Hashing

Hash passwords with PHP’s password API and rehash when needed.

Lesson

Password hashes are deliberately expensive one-way values. Use password_hash with PASSWORD_DEFAULT and password_verify for checks; PHP manages salts. Never use a fast general-purpose hash such as MD5 for passwords. password_needs_rehash can upgrade stored hashes after policy changes. Store the complete hash string in a column large enough for future algorithms. Further guidance Use PHP password hashing APIs, regenerate a session identifier after authentication, and clear session state during logout. Authentication identifies the user; authorization checks whether that user may perform this action on this record. Rate-limit sensitive endpoints and keep failure messages generic. Practice task: Create a fresh example for Password Hashing. Predict the result before running it, then change one input and explain why the result changes. Test a normal case and one boundary or invalid case where it applies. Compare your output with the example and note one rule you would use in a real project.

Code examples

Password Hashing

PHP

$hash = password_hash('example-password', PASSWORD_DEFAULT);
var_export(password_verify('example-password', $hash));

Expected output

true

Key points

Hash passwords with PHP’s password API and rehash when needed.
Store password hashes, not plaintext passwords.
Check authorization on every protected operation.

Your learning progress

Finish this lesson

Optional practice

PHP playground

This site does not execute learner-provided PHP code. Connect a secured PHP sandbox service before enabling code execution.

Execution is disabled. No code is sent to a server.