The best way to encrypt and decrypt passwords is to use a standard library in PHP because the method of properly encrypting and decrypting passwords from scratch is complex and involves multiple possibilities of security vulnerabilities. Using the standard library ensures that the hashing implementation is verified and trusted.
Note: This uses the PHP Password API available in version 5.5.0 and above.
Encryption of the password: To generate a hash from the string, we use the password_hash[] function.
Syntax:
string password_hash[string $password,
mixed $algo, [array $options]]The password_hash[] function creates a new password hash of the string using one of the available hashing algorithm. It returns the hash that is currently 60 character long, however, as new and stronger algorithms will be added to PHP, the length of the hash may increase. It is therefore recommended to allocate 255 characters for the column that may be used to store the hash in database.
The following algorithms are currently supported when using this function:
- PASSWORD_DEFAULT
- PASSWORD_BCRYPT
- PASSWORD_ARGON2I
- PASSWORD_ARGON2ID
Additional options can be passed to this function can be used to set the cost of encryption, the salt to be used during hashing, etc in the $options array.
The below example shows the method of using the password_hash[] method:
Example:
php
Output:
Generated hash: $2y$10$7rLSvRVyTQORapkDOqmkhetjF6H9lJHngr4hJMSM2lHObJbW5EQh6
Decryption of the password: To decrypt a password hash and retrieve the original string, we use the password_verify[] function.
Syntax:
bool password_verify[string $password, string $hash]
The password_verify[] function verifies that the given hash matches the given password, generated by the password_hash[] function. It returns true if the password and hash match, or false otherwise.
php
Output:
Password Verified!
PHP is a server-side scripting language designed specifically for web development. You can learn PHP from the ground up by following this PHP Tutorial and PHP Examples.
In this article, you will learn different ways to encrypt passwords using the PHP programming language. Generally, data is most vulnerable when it is being moved from one location to another. Encryption is the process through which information is encoded so it stays hidden from unauthorised users. It ensures private and sensitive data and can improve the security of communication between client apps and servers. Today, almost every application needs a password encryption technique to protect the sensitive information of its users.
PHP provides a range of different encryption methods. PHP has a hash algorithm to encrypt the password. The most commonly used functions for password encrypting are md5[], crypt[] and password_hash[].
Assume we have the registration form data in the POST, which includes the username and password. If we insert the same password as received in the POST into the database, this is not the secure way. If the database falls into the wrong hands, then they can misuse the data.
Encrypt password in PHP using md5
MD5 hashing algorithm generates a 32-characters string [hash hexadecimal number] for any word or phrase we give in the input. This is a one-way encryption algorithm. The password encrypted with this algorithm can never be decrypted. The md5 is the most commonly used encryption method. The md5[] function is used to calculate the md5 hash of a string. The syntax of the md5[] function is-
md5[string,raw]Here, the string is the string to be encrypted, and the row is an optional parameter. It specifies the output format, which can either be TRUE or FALSE. The default is FALSE.
The given code encrypts the password value and stores it in the database.