Tool
Password hash tester
Generate a bcrypt or Argon2 hash, verify one you already have, and time the cost factor on your own hardware.
Cost factor is the one password setting that has to be tuned per machine. A cost that takes 200 milliseconds on a modest shared host takes far less on faster hardware, and the right value is whatever is slow enough to matter to an attacker and fast enough that logins do not crawl.
Generate a hash here and the timing comes from this server, which is a reasonable stand-in for typical shared hosting.
Verify mode is the other half: paste a hash you already have, confirm a password against it, and see whether it should be rehashed at your current cost.
// Storing
$hash = password_hash($password, PASSWORD_BCRYPT, ['cost' => 12]);
// Checking, and upgrading old hashes on the way through
if (password_verify($password, $user['pass_hash'])) {
if (password_needs_rehash($user['pass_hash'], PASSWORD_BCRYPT, ['cost' => 12])) {
$new = password_hash($password, PASSWORD_BCRYPT, ['cost' => 12]);
// save $new against the user
}
}Notes
Do not enter a password you actually use. It travels in the query string, and while this page stores nothing, that is a habit worth not forming anywhere.
Store hashes in VARCHAR(255). bcrypt is 60 characters today, Argon2id is longer, and the next algorithm will be longer again. A CHAR(60) column silently truncates and every login fails.
password_needs_rehash lets you raise the cost without asking anyone to reset anything — upgrade the hash on the next successful login.
Never write your own hashing. password_hash already handles the salt, the format and the algorithm identifier.