Bcrypt in PHP: How to Hash Passwords Quickly and Without Errors

Bcrypt in PHP: How to Hash Passwords Quickly and Without Errors

Have you ever wondered why your PHP website slows down during user registration? Or, even worse, why hackers still manage to steal passwords from your database? The answer may lie in how you use bcrypt for hashing passwords in PHP.

This question is one of the most popular on Stack Overflow (thousands of views!). And it's no surprise: password security is a topic where one mistake can cost you your reputation and users their data. But today, we won't just cover how to use password_hash with bcrypt. We'll talk about optimization and performance. Because, let's face it, waiting 5 seconds to log in is not cool.

Let's figure out how to make password hashing in PHP not only secure but also fast. Let's go!

Why bcrypt? And why not MD5 or SHA?

Many beginners (and, unfortunately, some "experienced" developers) still use md5() or sha1(). This is like locking a door with a plastic latch — it looks closed, but one puff of air and it opens. MD5 and SHA are fast hashes. Too fast. A hacker with a modern GPU can brute-force billions of these hashes per second.

Bcrypt is a fundamentally different approach. It is intentionally designed to be slow. It uses a "salt" (random data) and a "cost factor," which forces the algorithm to take longer. While a hacker computes one bcrypt hash, they could have brute-forced a million MD5 hashes. That's why bcrypt is the de facto standard for PHP.

Basics: How to Use bcrypt in PHP Correctly

Since PHP 5.5, we have the magical function password_hash(). Forget about manually adding salt and calling crypt() — everything is already done for you.

Here's what proper password hashing with bcrypt looks like:

<?php\n// Hash the password\n$password = 'MySuperSecretPassword123!';\n$hash = password_hash($password, PASSWORD_BCRYPT);\n\necho $hash;\n// Output: $2y$10$... (a 60-character string)\n?>

That's it! password_hash automatically generates a random salt and selects an optimal cost factor (default is 10). And how do you verify the password during login?

<?php\n// Verify the password\n$inputPassword = 'MySuperSecretPassword123!';\n$hashFromDB = '$2y$10$...'; // the hash from the database\n\nif (password_verify($inputPassword, $hashFromDB)) {\n    echo "Password is correct! Welcome.";\n} else {\n    echo "Invalid password. Try again.";\n}\n?>

Simple, right? But as always, the devil is in the details. Let's talk about the most important thing — performance.

Optimizing bcrypt: How to Find the Balance Between Security and Speed

The main parameter affecting bcrypt performance in PHP is the cost factor. It is set as the second argument in password_hash() as an array ['cost' => 12].

What is cost? It's a logarithmic scale. Each unit increases the execution time by approximately 2 times.

\n
• Cost = 10 (default): ~0.1-0.2 seconds. Fast, but for 2024 it's already a bit low.
\n
• Cost = 12: ~0.4-0.8 seconds. A good balance for most projects.
\n
• Cost = 14: ~1.5-3 seconds. Very secure, but users will start to get impatient.
\n
• Cost = 16+: >5 seconds. Only if you're a spy or storing nuclear codes.
\n

How to choose the ideal cost? There's a simple rule: on your server, hashing a single password should take no more than 250-500 milliseconds. This is imperceptible to the user but makes brute-force attacks too expensive for a hacker.

Testing Performa