> ## Content Index
> Fetch the complete content index at: https://werd.io/llms.txt
> Use this file to discover other available public pages before exploring further.

# More secure password hashing in PHP 5.5
- URL: https://werd.io/more-secure-password-hashing-in-php-5-5/
- Published: 2012-09-12T19:42:51.000Z
- Updated: 2025-06-12T11:00:38.000Z
- Author: Ben Werdmuller
- Tags: Software development, #ben-684a32da145d7d001be71dae, bcrypt, password hashing, password_hash, php, php 5.5, security, #Migrated-1749693130536, #wp, #wp-post, #Import 2025-06-11 21:52

The most recent set of PHP releases suggest that the core development team are serious about keeping PHP at the forefront of web development technology, and [addressing some of its legacy criticisms](http://me.veekun.com/blog/2012/04/09/php-a-fractal-of-bad-design/). I've previously talked about the [JsonSerializable](http://benwerd.com/blog/2012/08/29/serializing-php-objects-into-json-with-jsonserializable/) interface; now, PHP 5.5 is introducing an easier way to make password hashing more secure.

(What is password hashing, and why is it important for protecting your users' privacy? [Here's a great introduction.](http://crackstation.net/hashing-security.htm))

[Here's the RFC, which was recently accepted](https://wiki.php.net/rfc/password%5Fhash). The idea is that too many people are using a naïve salting mechanism plus weak hash algorithm to store their passwords:

> `$hash = md5($password . $salt);`

This is subject to attack on a bunch of different levels. `bcrypt` is the generally-accepted algorithm for hashing passwords, but the truth is, new attacks emerge all the time, and the standard is going to be a constantly moving target.

The new PHP passwords API will abstract that away. All you'll do is get a hash like this:

> `$hash = password_hash($password);`

To verify a password, you can simply use:

> `if (password_verify($password, $hash)) { /* Yay */ } else { /* Uh oh */ }`

Salts and algorithms will be taken care of behind the scenes. Should you ever need to *re-hash* the password, at a point where you have the plain-text password, the `password_needs_rehash($hash)` function will let you know:

> `if (password_needs_rehash($hash)) { $hash = password_hash($password); // update hash in database }`

If you don't want to have the salts managed transparently for you, and want to set a higher computational cost on the hash algorithm than the default 10, you can specify them in the function options:

> `password_hash($password, PASSWORD_DEFAULT, array("cost" => 14, "salt" => $salt));`

[There's a compatible PHP shim](https://github.com/ircmaxell/password%5Fcompat) for coders who won't be using PHP 5.5 for a while yet.

I'm pretty excited about these additions to the PHP APIs. I'm also looking forward to checking out [Ratchet](http://socketo.me/), a way to develop real-time applications using WebSockets in PHP - something that removes a long-standing hole in the PHP functionality stack.

*Meanwhile, I'm still experimenting with more development-related posts. Again, please let me know if this was useful!*