Complete Guide to Password Hashing with bcrypt in PHP

Fundamental Principles of bcrypt Algorithm

bcrypt is a password hashing algorithm specifically designed for secure password storage, based on a modified version of Blowfish cipher called Eksblowfish. Unlike traditional hash functions, bcrypt implements computationally intensive operations through configurable rounds, significantly increasing the difficulty of brute-force attacks. The algorithm's core advantage lies in its adaptive nature, allowing computational costs to scale with hardware performance improvements.

The Eksblowfish algorithm introduces dual dependency on salt and user password during the key scheduling phase, ensuring each hash state is unique. This design makes bcrypt a true one-way hash function, where even if attackers obtain the hash value, they cannot reverse-engineer the original password. The algorithm's output includes algorithm identifier, cost factor, salt, and actual hash value, forming a complete self-contained structure.

Native Support in PHP 5.5+

Starting from PHP 5.5, the language includes built-in password hashing functions that greatly simplify bcrypt usage. The password_hash() function provides a simple and intuitive interface:

<?php
// Basic usage
$hash = password_hash('user_password', PASSWORD_DEFAULT);
// Output example: $2y$10$xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

// Custom cost factor
$options = [
    'cost' => 12
];
$hash = password_hash('user_password', PASSWORD_BCRYPT, $options);
?>

Password verification is equally straightforward using the password_verify() function:

<?php
$user_input = 'user_password';
$stored_hash = '$2y$10$xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx';

if (password_verify($user_input, $stored_hash)) {
    echo 'Password validation successful';
} else {
    echo 'Password mismatch';
}
?>

Compatibility Solutions for Older PHP Versions

For PHP versions 5.3.7 to 5.4.x, an official compatibility library provides identical functionality. This library fully emulates the PHP 5.5 API, ensuring forward compatibility:

<?php
require_once 'password_compat.php';

// Usage identical to native functions
$hash = password_hash('password', PASSWORD_BCRYPT);
$is_valid = password_verify('password', $hash);
?>

In earlier PHP versions, bcrypt can be manually implemented through the crypt() function, but this approach requires handling low-level details like salt generation and encoding. This method should only be used when absolutely necessary.

Security Enhancement Measures

Beyond basic bcrypt implementation, additional security can be achieved through pepper values. A pepper is a global secret key combined with the password before hashing:

<?php
$pepper = 'c1isvFdxMDdmjOlvxpecFw'; // Read from configuration file
$password = $_POST['password'];

// Add pepper using HMAC
$peppered_password = hash_hmac('sha256', $password, $pepper);
$hash = password_hash($peppered_password, PASSWORD_BCRYPT);

// Apply same processing during verification
$is_valid = password_verify(
    hash_hmac('sha256', $input_password, $pepper),
    $stored_hash
);
?>

This dual-layer protection mechanism ensures that even if the database is compromised, attackers cannot perform offline cracking directly—they must also obtain the pepper value to launch effective attacks.

Cost Factor Optimization Strategy

The bcrypt cost factor determines the strength of hash computation, requiring balance between security and performance. Recommended principles include:

• Use lower costs (e.g., 10) in development environments for faster testing
• Select appropriate values (typically 11-12) in production based on server performance
• Regularly evaluate and adjust cost factors to accommodate hardware evolution
• Use password_needs_rehash() to check if hash updates are needed

<?php
// Check if hash needs updating
if (password_needs_rehash($stored_hash, PASSWORD_BCRYPT, ['cost' => 12])) {
    $new_hash = password_hash($password, PASSWORD_BCRYPT, ['cost' => 12]);
    // Update hash value in database
}
?>

Practical Application Best Practices

When implementing bcrypt in real-world projects, consider the following best practices:

1. Always use the latest stable PHP version and password hashing functions
2. Generate unique salts for each user (automatically handled by bcrypt)
3. Store pepper values in configuration files separate from the database
4. Implement proper error handling and logging mechanisms
5. Conduct regular security audits and password policy evaluations

By following these guidelines, developers can build robust password systems capable of resisting modern attack vectors, providing reliable protection for user data.