Interview question

How should passwords be hashed and verified securely in PHP? PHP में passwords को securely hash और verify कैसे करें?

Answer

Never store plaintext or reversibly-encrypted passwords. Use PHP's built-in password_hash() which uses bcrypt (or Argon2) with automatic salting.

// Hashing on registration
$hashedPassword = password_hash($plainPassword, PASSWORD_DEFAULT);

// Verifying on login
if (password_verify($inputPassword, $hashedPassword)) {
    // Password is correct
}

// Checking if rehash is needed (e.g. after cost factor upgrade)
if (password_needs_rehash($hashedPassword, PASSWORD_DEFAULT)) {
    $newHash = password_hash($plainPassword, PASSWORD_DEFAULT);
}

Never do this	Why
md5($password)	Fast to brute-force, no salting
sha1($password)	Same issue - designed for speed, not security

Plaintext या reversible-encrypted passwords कभी store न करें। PHP का password_hash() इस्तेमाल करें जो bcrypt/Argon2 और automatic salting देता है।

$hashedPassword = password_hash($plainPassword, PASSWORD_DEFAULT);

if (password_verify($inputPassword, $hashedPassword)) {
    // Password सही है
}

कभी न करें	क्यों
md5($password)	Brute-force करना आसान, कोई salt नहीं

Was this answer clear?

Subjects

Related questions