crypt()

crypt() — One-way string hashing.

Built-in function of PHP 8.5. The manual lists it as available in PHP 4, PHP 5, PHP 7, PHP 8. This page is the reference card: signature, parameters and return value, plus the changelog and the example the manual provides.

What it does

crypt() will return a hashed string using the standard Unix DES-based algorithm or alternative algorithms. password_verify() is compatible with crypt(). Therefore, password hashes created by crypt() can be used with password_verify().

Signature

crypt(string $string, string $salt): string

Parameters

Parameter	Type	What it takes
$string	string	The string to be hashed.
$salt	string	A salt string to base the hashing on. If not provided, the behaviour is defined by the algorithm implementation and can lead to unexpected results.

Return value

Returns the hashed string or a string that is shorter than 13 characters and is guaranteed to differ from the salt on failure. When validating passwords, a string comparison function that isn't vulnerable to timing attacks should be used to compare the output of crypt() to the previously known hash. PHP provides hash_equals() for this purpose.

Example

A runnable snippet:

$user_input = 'rasmuslerdorf'; $hashed_password = '$6$rounds=1000000$NJy4rIPjpOaU$0ACEYGg/aKCY3v8O8AfyiO7CTfZQ8/W231Qfh2tRLmfdvFD6XfHk12u6hMr9cYIA4hnpjLNSTRtUwYr9km9Ij/'; // Validate an existing crypt() hash in a way that is compatible with non-PHP software. if (hash_equals($hashed_password, crypt($user_input, $hashed_password))) { echo "Password verified!"; }

Changelog

Version	Change
8.0.0	The salt is no longer optional.