array ( 0 => 'index.php', 1 => 'PHP Manual', ), 'head' => array ( 0 => 'UTF-8', 1 => 'uk', ), 'this' => array ( 0 => 'function.password-hash.php', 1 => 'password_hash', 2 => 'Creates a password hash', ), 'up' => array ( 0 => 'ref.password.php', 1 => 'Функції Хешування Пароля', ), 'prev' => array ( 0 => 'function.password-get-info.php', 1 => 'password_get_info', ), 'next' => array ( 0 => 'function.password-needs-rehash.php', 1 => 'password_needs_rehash', ), 'alternatives' => array ( ), 'source' => array ( 'lang' => 'en', 'path' => 'reference/password/functions/password-hash.xml', ), 'history' => array ( ), ); $setup["toc"] = $TOC; $setup["toc_deprecated"] = $TOC_DEPRECATED; $setup["parents"] = $PARENTS; manual_setup($setup); contributors($setup); ?>

password_hash

(PHP 5 >= 5.5.0, PHP 7, PHP 8)

password_hash — Creates a password hash

Опис

password_hash(#[\SensitiveParameter] string $password, string|int|null $algo, array $options = []): string

password_hash() creates a new password hash using a strong one-way hashing algorithm.

The following algorithms are currently supported:

Supported options for PASSWORD_BCRYPT:

Supported options for PASSWORD_ARGON2I and PASSWORD_ARGON2ID:

Параметри

password

Користувацький пароль.

Застереження

Using the PASSWORD_BCRYPT as the algorithm, will result in the password parameter being truncated to a maximum length of 72 bytes.

algo

Константа алгоритму для паролю, що позначає алгоритм для гешування пароля.

options

Асоціативниий масив опцій. Документація щодо доступних опцій для кожного алгоритму викладена на сторінці Константи алгоритмів для паролів.

Значення, що повертаються

Returns the hashed password.

The used algorithm, cost and salt are returned as part of the hash. Therefore, all information that's needed to verify the hash is included in it. This allows the password_verify() function to verify the hash without needing separate storage for the salt or algorithm information.

Журнал змін

Версія Опис
8.4.0 The default value of the cost option of the PASSWORD_BCRYPT algorithm was increased from 10 to 12.
8.3.0 password_hash() now sets the underlying Random\RandomException as the Exception::$previous exception when a ValueError is thrown due to a failure in the salt generation.
8.0.0 password_hash() no longer returns false on failure, instead a ValueError will be thrown if the password hashing algorithm is not valid, or an Error if the password hashing failed for an unknown error.
8.0.0 The algo parameter is nullable now.
7.4.0 The algo parameter expects a string now, but still accepts ints for backward compatibility.
7.4.0 The sodium extension provides an alternative implementation for Argon2 passwords.
7.3.0 Support for Argon2id passwords using PASSWORD_ARGON2ID was added.
7.2.0 Support for Argon2i passwords using PASSWORD_ARGON2I was added.

Приклади

Приклад #1 password_hash() example

<?php
echo password_hash("rasmuslerdorf", PASSWORD_DEFAULT);
?>

Поданий вище приклад виведе щось схоже на:

$2y$12$4Umg0rCJwMswRw/l.SwHvuQV01coP0eWmGzd61QH2RvAOMANUBGC.

Приклад #2 password_hash() example setting cost manually

<?php
$options = [
// Increase the bcrypt cost from 12 to 13.
'cost' => 13,
];
echo password_hash("rasmuslerdorf", PASSWORD_BCRYPT, $options);
?>

Поданий вище приклад виведе щось схоже на:

$2y$13$xeDfQumlmdm0Sco.4qmH1OGfUUmOcuRmfae0dPJhjX1Bq0yYhqbNi

Приклад #3 password_hash() example finding a good cost

This code will benchmark the machine to determine how high of a cost can be used without deteriorating user experience. It is recommended to set the highest cost that does not slow down other operations the machine needs to perform. 11 is a good baseline, and more is better if the machine is fast enough. The code below aims for ≤ 350 milliseconds stretching time, which is an appropriate delay for systems handling interactive logins.

<?php
$timeTarget = 0.350; // 350 milliseconds

$cost = 11;
do {
$cost++;
$start = microtime(true);
password_hash("test", PASSWORD_BCRYPT, ["cost" => $cost]);
$end = microtime(true);
} while (($end - $start) < $timeTarget);

echo "Appropriate Cost Found: " . $cost - 1;
?>

Поданий вище приклад виведе щось схоже на:

Appropriate Cost Found: 13

Приклад #4 password_hash() example using Argon2i

<?php
echo 'Argon2i hash: ' . password_hash('rasmuslerdorf', PASSWORD_ARGON2I);
?>

Поданий вище приклад виведе щось схоже на:

Argon2i hash: $argon2i$v=19$m=1024,t=2,p=2$YzJBSzV4TUhkMzc3d3laeg$zqU/1IN0/AogfP4cmSJI1vc8lpXRW9/S0sYY2i2jHT0

Примітки

Застереження

It is strongly recommended not to provide an explicit salt for this function. A secure salt will automatically be created if no salt is specified.

As noted above, providing the salt option in PHP 7.0.0 will generate a deprecation warning. Support for providing a salt explicitly has been removed in PHP 8.0.0.

Зауваження:

It is recommended to test this function on the machine used, adjusting the cost parameter(s) so that execution of the function takes less than 350 milliseconds for interactive logins. The script in the above example will help choosing an appropriate bcrypt cost for the given machine.

Зауваження: Updates to supported algorithms by this function (or changes to the default one) must follow the following rules:

  • Any new algorithm must be in core for at least 1 full release of PHP prior to becoming default. So if, for example, a new algorithm is added in 7.5.5, it would not be eligible for default until 7.7 (since 7.6 would be the first full release). But if a different algorithm was added in 7.6.0, it would also be eligible for default at 7.7.0.
  • The default should only change in a full release (7.3.0, 8.0.0, etc) and not in a revision release. The only exception to this is in an emergency when a critical security flaw is found in the current default.

Прогляньте також