password_hash returns different value every time

Question

I'm making a login system, and I want to hash the passwords to make them more secure, but it returns a different hash every time, and can't even be verified using password_verify(), here is my code:

$password = password_hash($password4, PASSWORD_DEFAULT);

and here is my code for verifying:

if(password_verify($password4, $dbpassword))

@PeeHaa It would take longer to crack it if it is hashed with different hashes multiple times — ItzBenteThePig
– ItzBenteThePig, Commented Oct 13, 2015 at 17:22
That assertion is incorrect @ItzBenteThePig - additional hashing makes for problems, rather than solutions. Think about what you're trying to protect. password_hash(), used correctly, provides random salts and long hashes that would take hundreds of years to crack. — Jay Blanchard
– Jay Blanchard, Commented Oct 13, 2015 at 17:23
One other note: Don't limit passwords. Passphrases are the key to higher security. — Jay Blanchard
– Jay Blanchard, Commented Oct 13, 2015 at 17:29
@ItzBenteThePig if you have followed, to the letter, how to hash and then verify the password then there is A.) an error we don't know about or 2.) some other code which might be interfering. — Jay Blanchard
– Jay Blanchard, Commented Oct 13, 2015 at 17:41

Machavity · Accepted Answer · 2015-10-13 17:35:59Z

59

So let's take it one part at a time

but it returns a different hash every time

That's the idea. password_hash is designed to generate a random salt every time. This means you have to break each hash individually instead of guessing one salt used for everything and having a huge leg up.

There's no need to MD5 or do any other hashing. If you want to raise the security of password_hash you pass a higher cost (default cost is 10)

$password = password_hash($password4, PASSWORD_DEFAULT, ['cost' => 15]);

As to verify

if(password_verify($password4, $dbpassword))

So $password4 should be your unhashed password and $dbpassword should be the hash you've stored in your database

answered Oct 13, 2015 at 17:35

Machavity♦

31.8k27 gold badges97 silver badges108 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

password_hash returns different value every time

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related