diff --git a/reference/password/functions/password-hash.xml b/reference/password/functions/password-hash.xml index b5f5fbc65d3f..eacf35cf798c 100644 --- a/reference/password/functions/password-hash.xml +++ b/reference/password/functions/password-hash.xml @@ -29,14 +29,14 @@ Note that this constant is designed to change over time as new and stronger algorithms are added to PHP. For that reason, the length of the result from using this identifier can change over time. Therefore, it is recommended to store the result in a database column that can expand - beyond 60 characters (255 characters would be a good choice). + beyond 60 bytes (255 bytes would be a good choice). PASSWORD_BCRYPT - Use the bcrypt algorithm to create the hash. This will produce a standard crypt compatible hash using - the $2y$ identifier. The result will always be a 60 character string, &return.falseforfailure;. + the $2y$ identifier. @@ -82,7 +82,7 @@ If omitted, a default value of 12 will be used. This is a good - baseline cost, but you may want to consider adjusting it depending on your hardware. + baseline cost, but it should be adjusted depending on hardware used. @@ -255,13 +255,6 @@ ]]> @@ -280,10 +273,8 @@ $2y$12$4Umg0rCJwMswRw/l.SwHvuQV01coP0eWmGzd61QH2RvAOMANUBGC. 13, ]; echo password_hash("rasmuslerdorf", PASSWORD_BCRYPT, $options); @@ -301,16 +292,17 @@ $2y$13$xeDfQumlmdm0Sco.4qmH1OGfUUmOcuRmfae0dPJhjX1Bq0yYhqbNi <function>password_hash</function> example finding a good cost + + This code will benchmark the machine to determine how high of a cost can be used + without deteriorating user experience. It is recommended to set the highest cost + that does not slow down other operations the machine needs to perform. 11 is a + good baseline, and more is better if the machine is fast enough. The code below + aims for ≤ 350 milliseconds stretching time, which is an appropriate delay for + systems handling interactive logins. + - It is strongly recommended that you do not generate your own salt for this - function. It will create a secure salt automatically for you if you do - not specify one. + It is strongly recommended not to provide an explicit salt for this function. + A secure salt will automatically be created if no salt is specified. - As noted above, providing the salt option in PHP 7.0 - will generate a deprecation warning. Support for providing a salt manually - has been removed in PHP 8.0. + As noted above, providing the salt option in PHP 7.0.0 + will generate a deprecation warning. Support for providing a salt explicitly + has been removed in PHP 8.0.0. - It is recommended that you test this function on your servers, and adjust the cost parameter - so that execution of the function takes less than 350 milliseconds on interactive systems. - The script in the above example will help you choose a good cost value for your hardware. + It is recommended to test this function on the machine used, adjusting the cost parameter(s) + so that execution of the function takes less than 350 milliseconds for interactive logins. + The script in the above example will help choosing an appropriate bcrypt cost for the given + machine.