PHP - Bcrypt hash comparison always fails

Question

<?php

require 'password.php';
$hash1 = password_hash('testpassword',PASSWORD_BCRYPT,array('cost' => 11));
$hash2 = password_hash('testpassword',PASSWORD_BCRYPT,array('cost' => 11));

if(password_verify($hash1,$hash2)) echo 'Pass';
else echo 'Fail';

?>

I'm trying to use bcrypt provided by the password_compat library with PHP 5.4.16, but this script always outputs "Fail" even though it's comparing two hashes of the same password, why?

Edit - Just for clarification, I realize the hashes aren't identical, otherwise I'd just compare them instead of using a function.

This is the point of hashing. No two are alike. I find using Blowfish makes life easier too — James
– James, Commented Feb 24, 2014 at 2:43

AnasSafi · Accepted Answer · 2021-11-12 02:16:22Z

14

You need to pass the password and the hash to password_verify():

password_verify('testpassword', $hash1)

Note: testpassword is password without hash

References:

http://php.net/manual/en/function.password-verify.php

PS: password_hash generates different results expectedly, since it contains a random salt

edited Nov 12, 2021 at 2:16

AnasSafi

6,3941 gold badge42 silver badges44 bronze badges

answered Feb 24, 2014 at 2:35

zerkms

256k73 gold badges447 silver badges551 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Cains Over a year ago

Gah, can't believe I overlooked that, I saw that they used a variable in the example and I assumed it was another hash. Thanks a lot, I'll accept the answer in a few minutes when it lets me.

Vladimir Over a year ago

@Cains That's why I use a specific PHP IDE - It suggests me a function with its parameters, like this: "password_verify(password: string, hash: string) bool"

Collectives™ on Stack Overflow

PHP - Bcrypt hash comparison always fails

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related