Beginner LevelPHP 8+
Why must you use password_hash() and password_verify() with BCRYPT/ARGON2ID instead of md5() or sha1()?
❓ Interview Prompt: Explain secure password hashing in PHP, why fast hashes (MD5/SHA256) are vulnerable to GPU brute-forcing, and Argon2id / Bcrypt key derivation.
Fast cryptographic hash functions like MD5, SHA1, or SHA256 must NEVER be used for passwords. High-speed GPUs can compute billions of MD5 hashes per second, cracking passwords easily.
The PHP Password Hashing API:
PHP provides built-in slow key-derivation algorithms resistant to GPU brute-forcing:
•
'password_hash($password, PASSWORD_ARGON2ID)': Winner of Password Hashing Competition (enforces memory, time, and thread work factors).
•
'password_hash($password, PASSWORD_BCRYPT)': Industry standard algorithm with configurable work cost factor.
•
Automatic Salt: Generates cryptographically secure random salts automatically per password.
•
'password_verify($input, $hash)': Validates passwords using constant-time comparison to prevent timing side-channel attacks.
Code Implementation Example
php
<?php
// 1. Hash password using Argon2id (or BCRYPT) with automatic salt
$hash = password_hash('user_secret_password', PASSWORD_ARGON2ID);
// 2. Verify input password securely against stored hash
$userSubmittedPassword = 'user_secret_password';
if (password_verify($userSubmittedPassword, $hash)) {
echo "Password verified successfully!";
} else {
echo "Invalid credentials.";
}💡Secure password hashing and constant-time verification using password_hash and password_verify.
🎯 Interview Key Takeaway
Use password_hash() with PASSWORD_ARGON2ID or BCRYPT and verify with password_verify() to defeat GPU password cracking.
#password_hash#Argon2id#Bcrypt#Security#Intermediate
Back to all PHP 8+ Questions→