How to encrypt and decrypt passwords using PHP ?

31 Jul, 2021
The best way to encrypt and decrypt passwords is to use a standard library in PHP because the method of properly encrypting and decrypting passwords from scratch is complex and involves multiple possibilities of security vulnerabilities. Using the standard library ensures that the hashing implementation is verified and trusted.
Note: This uses the PHP Password API available in version 5.5.0 and above.
Encryption of the password: To generate a hash from the string, we use the password_hash() function.
Syntax:
string password_hash(string $password, 
          mixed $algo, [array $options])
The password_hash() function creates a new password hash of the string using one of the available hashing algorithm. It returns the hash that is currently 60 character long, however, as new and stronger algorithms will be added to PHP, the length of the hash may increase. It is therefore recommended to allocate 255 characters for the column that may be used to store the hash in database.
The following algorithms are currently supported when using this function:
PASSWORD_DEFAULT
PASSWORD_BCRYPT
PASSWORD_ARGON2I
PASSWORD_ARGON2ID
Additional options can be passed to this function can be used to set the cost of encryption, the salt to be used during hashing, etc in the $options array.
The below example shows the method of using the password_hash() method:
Example:
php
<?php    // The plain text password to be hashed  $plaintext_password = "Password@123";    // The hash of the password that  // can be stored in the database  $hash = password_hash($plaintext_password,           PASSWORD_DEFAULT);    // Print the generated hash  echo "Generated hash: ".$hash;?>
Output:
Generated hash: $2y$10$7rLSvRVyTQORapkDOqmkhetjF6H9lJHngr4hJMSM2lHObJbW5EQh6
Decryption of the password: To decrypt a password hash and retrieve the original string, we use the password_verify() function.
Syntax:
bool password_verify(string $password, string $hash)
The password_verify() function verifies that the given hash matches the given password, generated by the password_hash() function. It returns true if the password and hash match, or false otherwise.
php
<?php    // Plaintext password entered by the user  $plaintext_password = "Password@123";    // The hashed password retrieved from database  $hash = "$2y$10$8sA2N5Sx/1zMQv2yrTDAaOFlbGWECrrgB68axL.hBb78NhQdyAqWm";    // Verify the hash against the password entered  $verify = password_verify($plaintext_password, $hash);    // Print the result depending if they match  if ($verify) {      echo 'Password Verified!';  } else {      echo 'Incorrect Password!';  }?>
Output:
Password Verified!
PHP is a server-side scripting language designed specifically for web development. You can learn PHP from the ground up by following this PHP Tutorial and PHP Examples.
PHP-Misc
Picked
PHP
PHP Programs
Web Technologies
Web technologies Questions
PHP
Writing code in comment?
Please use ide.geeksforgeeks.org,
generate link and share the link here.
How to convert array to string in PHP ?
PHP | Converting string to Date and DateTime
How to get parameters from a URL string in PHP?
Split a comma delimited string into an array in PHP
Removing Array Element and Re-Indexing in PHP
How to convert array to string in PHP ?
How to call PHP function on the click of a Button ?
How to get parameters from a URL string in PHP?
Split a comma delimited string into an array in PHP
How to pass JavaScript variables to PHP ?