Skip to content

Instantly share code, notes, and snippets.

@panique
Last active December 17, 2015 19:09
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save panique/5658534 to your computer and use it in GitHub Desktop.
Save panique/5658534 to your computer and use it in GitHub Desktop.
This is a simple demo of the new PHP 5.5 password functions.
<?php
// THOSE FUNCTIONS WILL WORK WITH PHP 5.5, if you want to use them with PHP 5.3 or 5.4
// you need to include the password.php file from this project:
// https://github.com/ircmaxell/password_compat/blob/master/lib/password.php
// require ('lib/password.php');
echo "Please note: These functions need at least PHP 5.3.7<br/>";
echo "You are running PHP ".phpversion();
echo "<br/>";
// hashing & salting a password (salt will be auto-generated)
$pass = 'mysecretpassword';
$hash = password_hash($pass, PASSWORD_DEFAULT);
echo $hash;
echo "<br/>";
echo "Length hash: ".strlen($hash)."<br/>";
// checking if the password fits to the saved hash/salt-string
var_dump(password_verify($pass, $hash));
echo "<br/>";
// checking if the password fits to the saved hash/salt-string
// intentionally using a wrong password
$wrong_pass = 'atotallywrongpassword';
var_dump(password_verify($wrong_pass, $hash));
echo "<br/>";
// getting info from hash string, useful for checking if the hash is outdated
// (happens when your hashes are hashed with cost factor 7,
// but after some time you decide to increase it to 8)
var_dump(password_get_info($hash));
echo "<br/>";
// checking the password rehash function
// same cost factor like before, so the function should return false
$options['cost'] = 10;
var_dump(password_needs_rehash($hash, PASSWORD_DEFAULT, $options));
echo "<br/>";
// we increase the cost factor, so the function should return true
$options['cost'] = 11;
var_dump(password_needs_rehash($hash, PASSWORD_DEFAULT, $options));
echo "<br/>";
// let's rehash a password with the new cost factor from $options:
// (btw 10 is the internal standard)
$hash = password_hash($pass, PASSWORD_DEFAULT, $options);
echo $hash;
echo "<br/>";
echo "Length hash: ".strlen($hash)."<br/>";
// finally, some time tests: cost factor 7
$options['cost'] = 7;
$runtime_start = microtime(true);
password_hash($pass, PASSWORD_DEFAULT, $options);
$runtime_end = microtime(true);
$runtime_total = $runtime_end - $runtime_start;
echo "Runtime for a hash with cost factor 7: ".$runtime_total." seconds<br/>";
// finally, some time tests: cost factor 10
$options['cost'] = 10;
$runtime_start = microtime(true);
password_hash($pass, PASSWORD_DEFAULT, $options);
$runtime_end = microtime(true);
$runtime_total = $runtime_end - $runtime_start;
echo "Runtime for a hash with cost factor 10: ".$runtime_total." seconds<br/>";
@panique
Copy link
Author

panique commented May 27, 2013

This will generate something similar to:

Please note: Those functions (and all other that use this version of BLOWFISH algorithm) need at least PHP 5.3.7
You are running PHP 5.3.21
$2y$10$/m.xxwGqroKHnI6/5XrsQOKMmejfFMmOW8JuLnAT.TLbTboyfi1.6
Length hash: 60
bool(true)
bool(false)
array(3) { ["algo"]=> int(1) ["algoName"]=> string(6) "bcrypt" ["options"]=> array(1) { ["cost"]=> int(10) } }
bool(false)
bool(true)
$2y$11$/YaA58m4HcKxmzva0AJnceWyeD9pKBSq.dJfpUGbwZgpAxPCoxHRe
Length hash: 60
Runtime for a hash with cost factor 7: 0.019093036651611 seconds
Runtime for a hash with cost factor 10: 0.14752817153931 seconds

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment