Skip to content

Instantly share code, notes, and snippets.

@Carlgo11
Created June 5, 2016 02:12
Show Gist options
  • Save Carlgo11/660757dbde460e03b77bfc4dc704aa45 to your computer and use it in GitHub Desktop.
Save Carlgo11/660757dbde460e03b77bfc4dc704aa45 to your computer and use it in GitHub Desktop.
<?php
# Time limit in seconds.
$limit = 2;
# Starting cost. Set higher if you want to skip low cost tests.
$cost = 1;
# Password to hash. It doesn't matter if it's a "secure" one or not.
$password = "password";
echo "<style>table, th, td {border: 1px solid black;border-collapse: collapse;}</style>";
function microtime_float() {
list($usec, $sec) = explode(" ", microtime());
return ((float) $usec + (float) $sec);
}
echo "<table>";
echo "<tr><td>Cost</td><td>Time difference</td></tr><tr>";
while (true == true) {
$start = microtime_float();
$hash = password_hash($password, PASSWORD_BCRYPT, array('cost' => $cost));
$end = microtime_float();
$diff = $end - $start;
echo '<td>' . $cost . '</td><td>' . $diff . "</td></tr>";
if ($diff >= $limit) {
echo "</table><br><b>Limit of " . $limit . " reached, stopping.</b>";
break;
} else {
$cost = $cost + 1;
}
}
?>
@Carlgo11
Copy link
Author

Carlgo11 commented Jun 5, 2016

A simple script that checks how great of a hash cost you can have until the host computer slows down too much.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment