Last updated: August 26, 2026.
Store passwords with PHP’s dedicated password-hashing API. A password hash is one-way; it is verified rather than decrypted.
Create a hash
<?php
$hash = password_hash($password, PASSWORD_DEFAULT);
$statement = $pdo->prepare(
'INSERT INTO users (email, password_hash) VALUES (:email, :hash)'
);
$statement->execute(['email' => $email, 'hash' => $hash]);Verify during sign-in
<?php
if ($user !== null && password_verify($password, $user['password_hash'])) {
if (password_needs_rehash($user['password_hash'], PASSWORD_DEFAULT)) {
$newHash = password_hash($password, PASSWORD_DEFAULT);
// Update the stored hash with a prepared statement.
}
session_regenerate_id(true);
}Use a column of at least 255 characters, allow PHP to generate salts, rate-limit login attempts, and use TLS. See password_hash().
